Read the docs
Red Hat Security Advisory

RHSA-2026:83849

Red Hat Hardened Images RPMs Security Update

Released 2026-10-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2026-71167 CVE-2026-109351 · GHSA-hf39-hrp5-hx3v

Denial of service in Gitoxide gix-pack via pack header object count

Priority MEDIUM 64

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00322 Published 2026-10-12 Partial fix · 0.75.0 CWE-770
TI-2026-71166 CVE-2026-109350 · GHSA-86jp-9qq8-2gwc

Denial of service in Gitoxide gix-pack lets malicious remotes crash fetch

Priority MEDIUM 64

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00321 Published 2026-10-12 Partial fix · 0.75.0 CWE-617
TI-2026-71165 CVE-2026-109349 · GHSA-wmw6-cp8f-c6q8

Reachable assertion in gix-pack panics clients on crafted pack header

Priority LOW 37

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.0027 Published 2026-10-12 Partial fix · 0.75.0 CWE-617