CVE-2026-109348 GitoxideLabs CVE debrief

Who should care

Defenders responsible for systems using Gitoxide gix-mailmap should assess exposure and prioritize verification and updates to version 0.35.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify gix-mailmap version, assess exposure in systems using affected versions, and monitor for potential denial of service attacks.

Why it matters

CVE-2026-109348 is a denial of service vulnerability in Gitoxide gix-mailmap before 0.35.0 that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Defenders should prioritize verifying and updating gix-mailmap to version 0.35.0 or later, and assess exposure in systems using affected versions.

• Denial of service attacks may be possible through exploitation of this vulnerability
• Verification of gix-mailmap version and exposure is necessary to prevent potential impact
• Defenders should monitor for potential attacks and prioritize updates to version 0.35.0 or later

Technical summary

The vulnerability is caused by quadratic-time parsing in Snapshot::from_bytes, which can be exploited by attackers to exhaust CPU. This can be done by committing a crafted .mailmap with descending-ordered entries, forcing repeated front inserts, and blocking workers running log, blame, or shortlog for minutes. The vulnerability impacts gix-mailmap before version 0.35.0. Defenders should prioritize verifying and updating gix-mailmap to version 0.35.0 or later, and assess exposure in systems using affected versions. Technical details are based on CVE Program and source item information.

Defensive priority

Defenders should prioritize verifying and updating gix-mailmap to version 0.35.0 or later, and assess exposure in systems using affected versions.

Recommended defensive actions

• Verify gix-mailmap version and update to 0.35.0 or later if necessary
• Assess exposure in systems using affected versions
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability. Limited information is available on potential exploitation or impact. Defenders should verify gix-mailmap version and assess exposure in systems using affected versions. Evidence is based on CVE Program and source item details, with limitations noted in source information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.