EUVD-2026-97650
GHSA-mjrq-mxwp-ch57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCommit crafted .mailmap to repository
-
DeliveryVictim runs log/blame/shortlog
-
ExploitSnapshot::from_bytes repeated front inserts
-
ExecutionQuadratic-time CPU exhaustion
-
ImpactWorker blocked for minutes
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Requires a repository containing a maliciously crafted .mailmap file whose entries are in descending order (forcing repeated front inserts during parsing), AND the gix-mailmap crate at a version before 0.35.0. Exploitation only triggers when a victim process invokes a mailmap-consuming operation - specifically git log, blame, or shortlog - so the limiting factor is the passive user interaction (UI:P): an operator or automated worker must actually run one of these commands against the attacker-influenced repository. Impact is limited to temporary CPU-bound denial of service (availability only); there is no code execution, data exposure, or persistence. |
| Impact | This is a genuine but low-urgency issue, correctly rated medium (CVSS 5.3). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L) shows a network-reachable, low-complexity flaw needing no privileges, but the only impact is Availability-Low (VC:N/VI:N) - consistent with CWE-407 (inefficient algorithmic complexity / quadratic-time parsing) causing CPU exhaustion rather than crash or data compromise. UI:P (passive user interaction) is the key risk-limiter: exploitation is not fully automatable because a victim must run a git operation (log, blame, shortlog) against the crafted repository. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there are no signals of active exploitation or weaponization. No SSVC data was provided. Net: a real, confirmed defect worth patching in Rust/gitoxide-based tooling, but not an emergency - impact is a temporary denial of service (workers blocked 'for minutes'), fully recoverable, with no confidentiality or integrity consequence. |
| Exploit ScenarioDerived | An attacker commits a crafted .mailmap file with descending-ordered entries to a repository (e.g. via a pull request, a public repo, or a mirror). When a developer, CI worker, or hosting service running gitoxide's gix-mailmap (<0.35.0) executes log, blame, or shortlog, Snapshot::from_bytes performs repeated front-inserts, triggering quadratic-time parsing that pins a CPU core for minutes. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
CPU exhaustion in the Gitoxide gix-mailmap crate before 0.35.0 lets a repository carrying a crafted .mailmap file drive quadratic-time parsing inside Snapshot::from_bytes, tying up a worker process for minutes. The trigger is a .mailmap whose entries are ordered in descending fashion, which forces repeated front insertions during parsing; exploitation requires a victim or automated worker to run a mailmap-consuming Gitoxide operation such as git log, blame, or shortlog against the attacker-influenced repository, so the practical barrier is that passive user interaction rather than authentication (CVSS:4.0/AV:N/AC:L/PR:N/UI:P and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Impact is limited to a temporary availability loss - no code execution, data exposure, or persistence - and no public exploit has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade the gix-mailmap dependency to 0.35.0 or later, and rebuild/redeploy any downstream tool that embeds the crate; the fix is documented in the upstream advisory at https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmpw-wwcm-r8rc, and the VulnCheck write-up at https://www.vulncheck.com/advisories/gitoxide-gix-mailmap-before-0.35.0-cpu-denial-of-service-via-mailmap-parsing can be used for tracking. Where an immediate upgrade is not feasible, restrict the blast radius by refusing to run mailmap-consuming commands (log, blame, shortlog) on untrusted or attacker-supplied repositories, sanitizing or stripping .mailmap files before processing (side effect: legitimate identity-mapping output will differ from upstream expectations), and wrapping such operations in strict timeouts or resource limits (side effect: slow but legitimate parses may be killed and jobs will fail rather than hang). Applying these compensating controls does not remove the vulnerable code path and should be treated as temporary until the crate is upgraded.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitoxide is a Rust reimplementation of Git, and gix-mailmap is the crate responsible for parsing .mailmap files, which Git uses to normalize author and committer identities (mapping old names/emails to canonical ones). The flaw is an algorithmic complexity issue (CWE-407, inefficient algorithm) in Snapshot::from_bytes: when .mailmap entries are presented in descending order, the parser repeatedly performs front insertions into an internal collection, producing O(n²) behavior instead of the expected near-linear parse. CPE cpe:2.3:a:gitoxidelabs:gix-mailmap:*:*:*:*:*:*:*:* confirms that all published versions below 0.35.0 of the crate are affected, and any downstream tool or service that embeds a vulnerable copy inherits the defect. Because the cost is CPU-bound, an attacker cannot gain code execution, read data, or persist; they can only stall mailmap-consuming operations (log, blame, shortlog) run by the victim.
Know when Gix Mailmap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Crafted repo is network-delivered with no auth (AV:N/PR:N), but a victim must run log/blame/shortlog (UI:R); impact is CPU-exhaustion DoS only, so A:L and C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB