CVE-2026-109350

6.5Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-617

Impact

A malicious remote repository can crash fetch operations and cause a denial of service when a client connects to it. The attacker needs the target to initiate a fetch from an untrusted remote server.

Root cause

A thin-pack with an OFS_DELTA entry whose base_distance exceeds pack_offset triggers an unhandled panic in LookupRefDeltaObjectsIter.

Affected systems

Gitoxide gix-pack before 0.75.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade gix-pack to version 0.75.0 or later. Until upgraded, avoid fetching or pulling from untrusted git remotes.

shell

$ cargo update -p gix-pack --precise 0.75.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109350