These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A denial-of-service vulnerability exists in Gitoxide gix-pack before version 0.75.0. An attacker can exploit this vulnerability by supplying a huge pack-header object count, which can cause the process to abort. This vulnerability has a CVSS score of 7.1 and is considered high severity. The vulnerability is caused by an uncontrolled memory allocation issue in the gix-pack library. An attacker can exploit [truncated]
CVE-2026-109350 is a denial-of-service vulnerability in Gitoxide gix-pack before version 0.75.0. The vulnerability allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. This issue is triggered when a REF_DELTA references an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, causing a panic in LookupRefDeltaObjectsIter that aborts [truncated]
A reachable assertion vulnerability exists in gix-pack before version 0.75.0. The pack header decoder accepts version 3, but an assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch. This vulnerability can lead to a denial-of-service attack, potentially causing instability and disrupting service. Defenders shou [truncated]
CVE-2026-109348 is a denial of service vulnerability in Gitoxide gix-mailmap before 0.35.0. It allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. This occurs when attackers commit a crafted .mailmap with descending-ordered entries, forcing repeated front inserts. This blocks workers running log, blame, or shortlog for minutes. Defenders should assess exposure and prior [truncated]
CVE-2026-100419 is a path validation bypass vulnerability in the worktree checkout mechanism of gitoxide gix-fs before version 0.23.0. This vulnerability allows attackers to escape the worktree directory via symlink manipulation, potentially leading to code execution or file manipulation. The vulnerability is considered high severity with a CVSS score of 7.3.
CVE-2026-91986 is a vulnerability in gitoxide gix-transport before version 0.59.2. The issue arises from the failure to filter control characters in git-daemon connect requests, which allows attackers to inject NUL/CR/LF bytes via crafted git URLs. This can lead to the injection of extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.
CVE-2025-24890 is a medium-severity vulnerability in the gitoxide Rust implementation of git, affecting Windows systems. An administrator running a dependent program with an unfiltered elevated token incorrectly trusts repositories controlled by another user. This allows repository configuration or hooks to execute commands with the administrator's privileges. The issue is fixed in version 0.13.3.
The gitoxide library (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. This CVE record was published on 2026-08-28T12:16:38.027Z and has not been modified since then. The submodule name validation function in gix-validate only checks the first occurrence of '..', allowing crafted names to bypass the check. Combined with a trust inheritance flaw in Submodule::o [truncated]
The vulnerability exists in gitoxide before version 0.52.1, where the software follows symlinks when reading the worktree .gitmodules file. This allows attackers to inject out-of-repository bytes into submodule metadata by creating a malicious repository with a symlinked .gitmodules pointing outside the repository tree. Users of gitoxide, especially those using versions before 0.52.1, should be aware of t [truncated]
The gitoxide library before version 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal attacks. This vulnerability can be exploited by crafting malicious submodule names with traversal segments, potentially redirecting state() and open() functions to repositories outside .git/modules. Affected systems should be updated to version 0.52.1 or later, and compensat [truncated]
The gix-worktree-state crate before version 0.33.0, part of the gitoxide project on Windows, has a vulnerability allowing writing of files outside the worktree. This occurs when core.symlinks is set to true and gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive materialization. Specifically, if a symlink entry is initially checked out at a path pointing outside the wo [truncated]
