Source: rust-gix-pack X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for rust-gix-pack. CVE-2026-109349[0]: | gitoxide gix-pack before 0.75.0 contains a reachable assertion in | BytesToEntriesIter::new_from_header: the pack header decoder accepts | version 3, but a release-enabled assert_eq! requires version 2. A | malicious remote can send a 12-byte pack header declaring version 3 | to panic the client and abort the clone or fetch. https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwg CVE-2026-109350[1]: | Gitoxide gix-pack before 0.75.0 contains a denial of service | vulnerability that allows malicious remotes to crash fetch | operations by sending crafted thin-pack OFS_DELTA entries. Attackers | can serve a thin pack with a REF_DELTA referencing an existing | object followed by an OFS_DELTA whose base_distance exceeds | pack_offset, triggering a panic in LookupRefDeltaObjectsIter that | aborts the fetch process. https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-mpf5-465h-mr53 CVE-2026-109351[2]: | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory | allocation vulnerability that allows remote attackers to abort the | process by supplying a huge pack-header object count. Malicious | remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, | forcing Tree::with_capacity to reserve hundreds of gigabytes and | crash clone or fetch operations. https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x862-c2wj-4mwr If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-109349 https://www.cve.org/CVERecord?id=CVE-2026-109349 [1] https://security-tracker.debian.org/tracker/CVE-2026-109350 https://www.cve.org/CVERecord?id=CVE-2026-109350 [2] https://security-tracker.debian.org/tracker/CVE-2026-109351 https://www.cve.org/CVERecord?id=CVE-2026-109351 Please adjust the affected versions in the BTS as needed.
