CVE-2026-109349
Received Received - Intake

Remote Panic via Malicious Pack Header in gitoxide

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109349
EUVD
EUVD-2026-97651

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GitoxideLabs gix-pack 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109349 is a reachable assertion denial-of-service (DoS) vulnerability in gitoxide's gix-pack crate versions before 0.75.0. It occurs when a malicious remote sends a 12-byte pack header declaring version 3, which the decoder accepts but later triggers an assertion requiring version 2. This causes a panic, aborting clone or fetch operations.

Detection Guidance

To detect this vulnerability, check the version of gix-pack in use. If you are using a version before 0.75.0, your system is vulnerable. Run commands like 'cargo tree -p gix-pack' in Rust projects or inspect dependency files for gix-pack versions.

Impact Analysis

This vulnerability allows an attacker to remotely crash your git client during clone or fetch operations by sending a specially crafted 12-byte header. This results in a denial-of-service, preventing you from accessing or updating repositories.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) by crashing the git client during clone or fetch operations. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, the DoS could disrupt access to critical systems, potentially impacting availability requirements in these regulations.

Mitigation Strategies

Immediately update gix-pack to version 0.75.0 or later. If updating is not possible, restrict network access to git repositories or disable clone/fetch operations until patched. Monitor for unusual network traffic patterns indicating exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart