CVE-2026-91986 GitoxideLabs CVE debrief

Who should care

Defenders responsible for managing git-daemon instances or using gitoxide gix-transport in their environments should be aware of this vulnerability. This includes developers, system administrators, and security professionals who oversee the use of git-based tools and services.

Why it matters

CVE-2026-91986 is a medium-severity vulnerability in gitoxide gix-transport that allows control character injection in git-daemon connect requests. Defenders should verify the version of gix-transport in use, assess exposure, and monitor for suspicious activity. The vulnerability's impact is primarily related to potential spoofing and log injection, and its exploitation requires specific conditions to be met.

• Spoofing of virtual hosts via injected NUL-delimited protocol fields.
• Injection of newlines into daemon requests and logs, potentially leading to log pollution or request manipulation.
• Verification of gix-transport version in use and potential exposure to git-daemon connect requests.
• Assessment of git-daemon instance security and monitoring for suspicious activity.

Technical summary

The gitoxide gix-transport library before version 0.59.2 does not properly filter control characters in git-daemon connect requests. This allows an attacker to inject NUL/CR/LF bytes into the request, potentially leading to the injection of extra NUL-delimited protocol fields or newlines into daemon requests and logs. The vulnerability can be exploited by crafting git URLs that inject control characters, allowing attackers to spoof virtual hosts or inject newlines into daemon requests and logs. Defenders should verify the version of gix-transport in use, assess exposure, and monitor for suspicious activity related to git-daemon requests and logs.

Defensive priority

Defenders should prioritize verifying the version of gix-transport in use and assessing exposure to git-daemon connect requests. This involves checking for any instances of gitoxide gix-transport in the environment and ensuring they are updated to version 0.59.2 or later. Additionally, monitoring for suspicious activity related to git-daemon requests and logs is recommended.

Recommended defensive actions

• Verify the version of gix-transport in use and update to version 0.59.2 or later if necessary.
• Assess exposure to git-daemon connect requests and monitor for suspicious activity.
• Review git-daemon requests and logs for any signs of injected newlines or spoofed virtual hosts.
• Perform a thorough review of git-daemon instance security and ensure proper configuration.
• Monitor for any unusual activity related to git-daemon requests and logs.
• Conduct a comprehensive asset inventory to identify all instances of gitoxide gix-transport in the environment.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. The CVE description provides details on the vulnerability, including its impact and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.