Read the docs
TI-2026-71165 Aliases CVE-2026-109349GHSA-wmw6-cp8f-c6q8

Reachable assertion in gix-pack panics clients on crafted pack header

Priority LOW 37CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

The gix-pack crate in gitoxide before 0.75.0 contains a reachable assertion (CWE-617) in its pack header decoder, which accepts version 3 while a release-enabled assertion requires version 2. A malicious remote server can send a crafted 12-byte pack header declaring version 3 to crash a client during a clone or fetch, and a user must perform that clone or fetch.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Partial gix-pack (GitoxideLabs): 0.75.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitoxideLabsgix-packbefore 0.75.00.75.0Patch availableCNA
  • gix-pack VendorGitoxideLabs Affected before 0.75.0 Fixed in 0.75.0 Patch available CNA

Remediation

Upgrade gix-pack to version 0.75.0. Red Hat fixes this in Red Hat Hardened Images through RHSA-2026:83849 and RHSA-2026:83879. The sources list no fixed version for Red Hat Enterprise Linux 8, 9 and 10.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA gix-pack (GitoxideLabs) Fixed in 0.75.0

Red Hat 2 advisories

  • RHSA-2026:83879 Released 2026-10-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cargo-1.99.1-1.1.hum1@aarch64, cargo-1.99.1-1.1.hum1@s390x, cargo-1.99.1-1.1.hum1@x86_64 +47
  • RHSA-2026:83849 Released 2026-10-16 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images cargo-1.99.0-1.1.hum1@aarch64, cargo-1.99.0-1.1.hum1@s390x, cargo-1.99.0-1.1.hum1@x86_64 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitoxideLabs gix-pack 0.75.0

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-71167 Denial of service in Gitoxide gix-pack via pack header object countPriority MEDIUM 64
    • TI-2026-71166 Denial of service in Gitoxide gix-pack lets malicious remotes crash fetchPriority MEDIUM 64
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:83849, RHSA-2026:83879

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109349
  2. 2026-10-12 Alias added: GHSA-wmw6-cp8f-c6q8
  3. 2026-10-13 Affected versions changed · Red Hat
  4. 2026-10-13 CVSS score added · Red Hat
  5. 2026-10-13 Priority changed: MEDIUM → LOW
  6. 2026-10-13 CISA SSVC decision points changed
  7. 2026-10-18 Fix available: RHSA-2026:83849 · Red Hat
  8. 2026-10-18 Fix available: Red Hat Hardened Images · Red Hat
  9. 2026-10-20 Fix available: RHSA-2026:83879 · Red Hat
  10. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
  • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
  • TI-2026-56716 gitoxide before 0.52.1 Path Traversal via Submodule Name CVSS 4.0HIGH 8.7
  • TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
  • TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences