CVE-2026-109350 GitoxideLabs CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that use Gitoxide gix-pack should be aware of this vulnerability and take steps to mitigate it. This includes verifying the version of gix-pack in use and upgrading to version 0.75.0 or later to prevent potential denial-of-service attacks. Operators, security teams, and vulnerability management teams should review advisory information and assess potential impacts on their environments.

Why it matters

CVE-2026-109350 is a denial-of-service vulnerability in Gitoxide gix-pack before version 0.75.0 that allows malicious remotes to crash fetch operations. Defenders should verify the version of gix-pack in use and upgrade to version 0.75.0 or later to mitigate this vulnerability.

• Denial-of-service attacks may be possible against systems using vulnerable versions of gix-pack.
• Defenders should verify the version of gix-pack in use and upgrade to version 0.75.0 or later to prevent potential denial-of-service attacks.
• The vulnerability may be exploited by malicious remotes to crash fetch operations.

Technical summary

The vulnerability is caused by a lack of proper validation of OFS_DELTA entries in the gix-pack library. An attacker can exploit this vulnerability by serving a crafted thin pack that triggers a panic in the LookupRefDeltaObjectsIter function, aborting the fetch process. This issue is triggered when a REF_DELTA references an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, causing a denial-of-service vulnerability in Gitoxide gix-pack before version 0.75.0. Defenders should focus on version verification and potential impacts.

Defensive priority

Defenders should prioritize verifying the version of gix-pack in use and upgrading to version 0.75.0 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the version of gix-pack in use
• Upgrade to version 0.75.0 or later
• Monitor for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, there is limited information on potential exploits or attacks. Defenders should verify the version of gix-pack in use and review advisory information for CVE-2026-109350. Limited source information is available, so defenders must focus on version verification and potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.