CVE-2026-109350
Received Received - Intake

Denial of Service in Gitoxide gix-pack via Malicious Thin-Pack

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109350
EUVD
EUVD-2026-97652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GitoxideLabs gix-pack 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue in Gitoxide's gix-pack crate before version 0.75.0. It occurs when a malicious remote sends crafted thin-pack OFS_DELTA entries during a fetch operation. The attack involves an OFS_DELTA base_distance value larger than the pack_offset, causing a panic in the LookupRefDeltaObjectsIter function that aborts the fetch process.

Detection Guidance

Check the version of gix-pack in use with commands like 'cargo tree -p gix-pack' or 'gitoxide --version'. If the version is less than 0.75.0, the system is vulnerable. Monitor network traffic for thin-pack operations with crafted OFS_DELTA entries causing fetch crashes.

Impact Analysis

If you use Gitoxide versions 0.74.2 or earlier, an attacker could crash your fetch operations by sending specially crafted data. This only affects fetches into repositories that already have objects; fresh clones are not impacted. The attack requires network access and can disrupt normal Git operations.

Mitigation Strategies

Upgrade gix-pack to version 0.75.0 or later immediately. Avoid fetching from untrusted remotes until patched. Implement input validation for pack entries in custom Git clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart