Read the docs
TI-2026-71166 Aliases CVE-2026-109350GHSA-86jp-9qq8-2gwc

Denial of service in Gitoxide gix-pack lets malicious remotes crash fetch

Priority MEDIUM 64CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

Gitoxide gix-pack before 0.75.0 contains a denial of service flaw caused by a reachable assertion (CWE-617). A malicious remote can serve a crafted thin pack with an OFS_DELTA entry whose base distance exceeds the pack offset, which triggers a panic. The panic aborts the fetch process when a user fetches from that remote.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix Partial gix-pack (GitoxideLabs): 0.75.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitoxideLabsgix-packbefore 0.75.00.75.0Patch availableCNA
  • gix-pack VendorGitoxideLabs Affected before 0.75.0 Fixed in 0.75.0 Patch available CNA

Remediation

Update gix-pack to version 0.75.0, the fixed version. Red Hat fixes Red Hat Hardened Images in RHSA-2026:83879 and RHSA-2026:83849. Red Hat Enterprise Linux 8, 9 and 10 are affected, with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA gix-pack (GitoxideLabs) Fixed in 0.75.0

Red Hat 2 advisories

  • RHSA-2026:83879 Released 2026-10-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cargo-1.99.1-1.1.hum1@aarch64, cargo-1.99.1-1.1.hum1@s390x, cargo-1.99.1-1.1.hum1@x86_64 +47
  • RHSA-2026:83849 Released 2026-10-16 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images cargo-1.99.0-1.1.hum1@aarch64, cargo-1.99.0-1.1.hum1@s390x, cargo-1.99.0-1.1.hum1@x86_64 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GitoxideLabs gix-pack 0.75.0

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-71167 Denial of service in Gitoxide gix-pack via pack header object countPriority MEDIUM 64
    • TI-2026-71165 Reachable assertion in gix-pack panics clients on crafted pack headerPriority LOW 37
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:83849, RHSA-2026:83879

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109350
  2. 2026-10-12 Alias added: GHSA-86jp-9qq8-2gwc
  3. 2026-10-13 Affected versions changed · Red Hat
  4. 2026-10-13 CVSS score added · Red Hat
  5. 2026-10-13 Priority changed: MEDIUM → LOW
  6. 2026-10-13 CISA SSVC decision points changed
  7. 2026-10-13 Priority changed: LOW → MEDIUM
  8. 2026-10-18 Fix available: RHSA-2026:83849 · Red Hat
  9. 2026-10-18 Fix available: Red Hat Hardened Images · Red Hat
  10. 2026-10-20 Fix available: RHSA-2026:83879 · Red Hat
  11. 2026-10-20 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
  • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
  • TI-2026-56716 gitoxide before 0.52.1 Path Traversal via Submodule Name CVSS 4.0HIGH 8.7
  • TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
  • TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences