CVE-2026-82669
Received Received - Intake

XML Parsing Denial of Service in GitList

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82669
EUVD
EUVD-2026-68453

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
klaussilveira gitlist to 3.0.0-beta (inc)
klaussilveira gitlist 2.0.0
klaussilveira gitlist 3.0.0-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in GitList 2.0.0 caused by improper handling of XML parsing in the SimpleXMLElement function. Attackers can exploit it by creating malicious Git commit metadata containing XML-breaking characters like & or <. When GitList processes these commits, it fails to parse the malformed XML, leading to HTTP 500 errors and crashing the application.

Detection Guidance

Check GitList instances for HTTP 500 errors when accessing routes like /xmlbomb, /xmlbomb/commits/master, or /xmlbomb/feed/master.rss. Inspect logs for SimpleXMLElement parsing failures. Verify if commit metadata contains unescaped XML-breaking characters like & or <.

Impact Analysis

This vulnerability allows remote attackers to crash GitList instances by submitting specially crafted Git repositories. This results in denial-of-service, making the application unavailable for all users. It requires no authentication and can be triggered by accessing specific routes like /xmlbomb or /feed/master.rss.

Compliance Impact

This vulnerability causes denial of service via XML parsing failures, which could disrupt access to Git repository data. For compliance standards like GDPR or HIPAA, such disruptions may impact availability of required documentation or audit logs stored in repositories, potentially leading to non-compliance if critical data becomes inaccessible during incidents.

Mitigation Strategies

Upgrade GitList to version 3.0.0-beta or later to address the XML parsing issue. Apply the patch f67609d52c1812fa8a7ed80eae5e795cfd72115f if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart