debian/rust-gix-pack vulnerabilities

Latest debian/rust-gix-pack CVEs

Newest publication first

1. CVE-2026-109350 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

   Published 2026-10-12

   High·CVSS 7.1 EPSS 0.32%

   Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DE...

2. CVE-2026-109351 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

   Published 2026-10-12

   High·CVSS 7.1 EPSS 0.32%

   Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::wi...

3. CVE-2026-109349 gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

   Published 2026-10-12

   High·CVSS 7.1 EPSS 0.27%

   gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic th...

4. CVE-2026-82254 gitoxide before 0.69.0 Denial of Service via gix-pack

   Published 2026-08-28

   High·CVSS 8.7 EPSS 0.49%

   gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.