Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: GitoxideLabs gix-pack 0.75.0 Clear all filters
TI-2026-71167 CVE-2026-109351 · GHSA-hf39-hrp5-hx3v

Denial of service in Gitoxide gix-pack via pack header object count

Priority MEDIUM 64

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00322 Published 2026-10-12 Partial fix · 0.75.0 CWE-770
TI-2026-71166 CVE-2026-109350 · GHSA-86jp-9qq8-2gwc

Denial of service in Gitoxide gix-pack lets malicious remotes crash fetch

Priority MEDIUM 64

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00321 Published 2026-10-12 Partial fix · 0.75.0 CWE-617
TI-2026-71165 CVE-2026-109349 · GHSA-wmw6-cp8f-c6q8

Reachable assertion in gix-pack panics clients on crafted pack header

Priority LOW 37

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.0027 Published 2026-10-12 Partial fix · 0.75.0 CWE-617