Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2026-0810

Gix-date: gix-date: undefined behavior due to invalid string generation

A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs Redhat
Products
Gix-date Enterprise Linux Logging
CVE-2026-109351

Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs
Products
Gix-date
CVE-2026-109350

Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs
Products
Gix-date
CVE-2026-109349

gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs
Products
Gix-date
CVE-2026-109348

Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitoxidelabs
Products
Gix-date