EUVD-2026-67706
GHSA-5v2g-4955-9qfh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable without any authentication; both vectors terminate only the gitoxide process, giving S:U and A:H with no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.
AnalysisAI
Denial-of-service in gitoxide's gix-pack crate before 0.69.0 exposes Rust Git clients to remote process crashes during clone or fetch operations via two distinct attack vectors. Unchecked array indexing in the delta application routine causes index-out-of-bounds panics on truncated pack data, while uncapped buffer allocation from attacker-controlled LEB128 size headers allows a 10-byte crafted pack entry to trigger an immediate out-of-memory process kill - both exploitable by any Git server the victim connects to. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim's gitoxide process to perform a clone or fetch operation against a Git remote controlled by the attacker, or for an attacker to intercept an unencrypted git:// protocol connection between the victim and a legitimate server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is well-supported by the described mechanics - exploitation requires only a network connection to a malicious Git remote, no authentication to the victim system, and no user interaction beyond initiating a clone or fetch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the gix-pack crate to version 0.69.0 (or the gitoxide workspace to 0.69.0), which resolves both the unchecked array indexing panics and the uncapped allocation issue per the vendor advisory at https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x494-mj8g-cj27. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using gitoxide or gix-pack crate (including transitive dependencies), particularly CI/CD platforms, package managers, and automated Git tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in the gitoxide Rust library (gix-submodule crate before 0.82.0, gix before 0.83.0) allows attackers c
Path traversal and trust inheritance flaws in gitoxide's Rust crates gix (≤ 0.72.0) and gix-validate (≤ 0.10.0) allow an
Symlink following in gitoxide before 0.52.1 and the gix crate before 0.83.0 allows an attacker who supplies a malicious
Path traversal in gitoxide before 0.52.1 and gix before 0.83.0 allows an attacker who supplies a malicious git repositor
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (pass
Index-out-of-bounds panic in gitoxide's gix-packetline library (versions before 0.21.5) allows a malicious Git server to
Arbitrary file write outside the worktree boundary in gix-worktree-state (part of gitoxide) before 0.33.0 on Windows ena
Credential hijacking in gitoxide before 0.38.2 allows remote attackers to redirect credential helper lookups to attacker
Same weakness CWE-248 – Uncaught Exception
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today