Gitoxidelabs - vulnerabilities (CVEs)

22 CVEs in 6 products, 4 in the last 30 days, newest from 2026-10-12.

Products

• Gitoxide - 12 CVEs
• Gix-pack - 3 CVEs
• Gix-date - 1 CVEs
• Gix-fs - 1 CVEs
• Gix-mailmap - 1 CVEs
• Gix-transport - 1 CVEs

Newest CVEs of Gitoxidelabs

• CVE-2026-109350 - CVSS 7.1 (high), 2026-10-12: Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted…
• CVE-2026-109351 - CVSS 7.1 (high), 2026-10-12: Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge…
• CVE-2026-109349 - CVSS 7.1 (high), 2026-10-12: gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a…
• CVE-2026-109348 - CVSS 5.3 (medium), 2026-10-12: Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in…
• CVE-2026-100419 - CVSS 7.3 (high), 2026-09-25: gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree…
• CVE-2026-91986 - CVSS 5.4 (medium), 2026-09-15: gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via…
• CVE-2025-24890 - CVSS 6.8 (medium), 2026-09-14: gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user…
• CVE-2026-82254 - CVSS 8.7 (high), 2026-08-28: gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack.…
• CVE-2026-82255 - CVSS 7.6 (high), 2026-08-28: gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to…
• CVE-2026-82253 - CVSS 8.7 (high), 2026-08-28: gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in…
• CVE-2026-82251 - CVSS 8.7 (high), 2026-08-28: gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories.…
• CVE-2026-82252 - CVSS 8.7 (high), 2026-08-28: gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule…
• CVE-2026-82250 - CVSS 7.1 (high), 2026-08-28: gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines…
• CVE-2026-82249 - CVSS 3.1 (low), 2026-08-28: gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare…
• CVE-2026-82248 - CVSS 6 (medium), 2026-08-28: gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing…
• CVE-2026-82247 - CVSS 8.7 (high), 2026-08-28: gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component,…
• CVE-2026-40034 - CVSS 8.5 (high), 2026-05-26: gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass…
• CVE-2026-44471 - CVSS 7.8 (high), 2026-05-13: gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit…
• CVE-2026-0810 - CVSS 7.1 (high), 2026-01-26: A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates…
• CVE-2023-53158 - CVSS 4.1 (medium), 2025-07-28: The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was…
• CVE-2025-31130 - CVSS 6.8 (medium), 2025-04-04: gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it…
• CVE-2025-22620 - CVSS 5 (medium), 2025-01-20: gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files,…