CVE-2026-109351 | BDVDB-2026-386397 Detail
GitoxideLabsgix-pack
Description#
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-770 Allocation of Resources Without Limits or Throttling
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.