Read the docs
TI-2026-71164 Aliases CVE-2026-109348GHSA-mjrq-mxwp-ch57

Gitoxide gix-mailmap CPU exhaustion from quadratic .mailmap parsing

Priority MEDIUM 57CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

Gitoxide gix-mailmap from 0 before 0.35.0 parses .mailmap files in quadratic time in Snapshot::from_bytes, an inefficient algorithmic complexity flaw (CWE-407). An attacker who can commit a crafted .mailmap file exhausts CPU and blocks workers running log, blame, or shortlog for minutes.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00296 22nd percentileScored 2026-11-07
Fix Fixed gix-mailmap (GitoxideLabs): 0.35.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitoxideLabsgix-mailmapbefore 0.35.00.35.0Patch availableCNA
  • gix-mailmap VendorGitoxideLabs Affected before 0.35.0 Fixed in 0.35.0 Patch available CNA

Remediation

Upgrade gix-mailmap to 0.35.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA gix-mailmap (GitoxideLabs) Fixed in 0.35.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109348
  2. 2026-10-12 Alias added: GHSA-mjrq-mxwp-ch57
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM
  5. 2026-11-03 Affected versions changed · Red Hat
  6. 2026-11-03 CVSS score added · Red Hat

References

Advisory 1

  • TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
  • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
  • TI-2026-56716 gitoxide before 0.52.1 Path Traversal via Submodule Name CVSS 4.0HIGH 8.7
  • TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
  • TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences