CVE-2026-109349

A flaw was found in gix-pack. A malicious remote server can trigger a Denial of Service DoS by returning a crafted pack header declaring version 3 during a repository clone or fetch operation. Because the header decoder triggers an internal assertion failure when encountering this version, the...

CVE-2026-109351

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service DoS by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation,...

CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351

The gitoxide gix-pack component (versions before 0.75.0 ) is vulnerable to an uncontrolled memory allocation flaw (CWE-770). A remote attacker can trigger a Denial of Service by providing a 12-byte pack header claiming a massive object count (e.g., 0xFFFFFFFF). This forces the Tree::with_capacity...

EUVD-2026-97653

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...