CVE-2026-109351GHSA-x862-c2wj-4mwr
Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count
GitoxideLabs gix-pack
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.75.0gix-packCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
Text from CVE List
Affected versions 2
- gix-packaffected: all versions before 0.75.0CVE List
- gix-packunaffected: 0.75.0CVE List