Gix Mailmap
Monthly
CPU exhaustion in the Gitoxide gix-mailmap crate before 0.35.0 lets a repository carrying a crafted .mailmap file drive quadratic-time parsing inside Snapshot::from_bytes, tying up a worker process for minutes. The trigger is a .mailmap whose entries are ordered in descending fashion, which forces repeated front insertions during parsing; exploitation requires a victim or automated worker to run a mailmap-consuming Gitoxide operation such as git log, blame, or shortlog against the attacker-influenced repository, so the practical barrier is that passive user interaction rather than authentication (CVSS:4.0/AV:N/AC:L/PR:N/UI:P and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Impact is limited to a temporary availability loss - no code execution, data exposure, or persistence - and no public exploit has been identified at time of analysis.
CPU exhaustion in the Gitoxide gix-mailmap crate before 0.35.0 lets a repository carrying a crafted .mailmap file drive quadratic-time parsing inside Snapshot::from_bytes, tying up a worker process for minutes. The trigger is a .mailmap whose entries are ordered in descending fashion, which forces repeated front insertions during parsing; exploitation requires a victim or automated worker to run a mailmap-consuming Gitoxide operation such as git log, blame, or shortlog against the attacker-influenced repository, so the practical barrier is that passive user interaction rather than authentication (CVSS:4.0/AV:N/AC:L/PR:N/UI:P and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Impact is limited to a temporary availability loss - no code execution, data exposure, or persistence - and no public exploit has been identified at time of analysis.