CVE-2026-0810
Gix-date: gix-date: undefined behavior due to invalid string generation
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gix-date: gix-date: undefined behavior due to invalid string generation
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
- Record
CVE-2026-0810- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-135
- Updated
- 2026-11-05
EUVDEUVD-2026-4669
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
- Record
EUVD-2026-4669- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-6mw6-mj76-grwc
gix-date can create non-utf8 string with `TimeBuf::as_str`
The function gix_date::parse::TimeBuf::as_str can create an illegal string containing non-utf8 characters. This violates the safety invariant of TimeBuf and can lead to undefined behavior when consuming the string.
The bug can be prevented by adding str::from_utf8 to the function TimeBuf::write.
- Record
GHSA-6mw6-mj76-grwc- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
- Record
CVE-2026-0810- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-135, CWE-682
- Updated
- 2026-11-05
OSV
Gix-date: gix-date: undefined behavior due to invalid string generation
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
- Record
CVE-2026-0810- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-135
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-0810
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
- Record
DEBIAN-CVE-2026-0810- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-06
OSVGHSA-6mw6-mj76-grwc
gix-date can create non-utf8 string with `TimeBuf::as_str`
The function gix_date::parse::TimeBuf::as_str can create an illegal string containing non-utf8 characters. This violates the safety invariant of TimeBuf and can lead to undefined behavior when consuming the string.
The bug can be prevented by adding str::from_utf8 to the function TimeBuf::write.
- Record
GHSA-6mw6-mj76-grwc- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-0810
A flaw was found in gix-date. The gix_date::parse::TimeBuf::as_str function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the TimeBuf component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
- Record
UBUNTU-CVE-2026-0810- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVRUSTSEC-2025-0140 No score
Non-utf8 String can be created with `TimeBuf::as_str`
The function gix_date::parse::TimeBuf::as_str can create an illegal string containing non-utf8 characters. This violates the safety invariant of TimeBuf and can lead to undefined behavior when consuming the string.
The bug can be prevented by adding str::from_utf8 to the function TimeBuf::write.
- Record
RUSTSEC-2025-0140- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gix-datecrates.io |
before 0.12.0 | 0.12.0 |
rust-gix-dateDebian:13 |
All versions, plus listed versions 0.10.7-10.15.3-10.15.6-10.16.0-10.18.0-10.9.3-10.9.3-2 |
None known |
rust-gix-dateDebian:14 |
All versions, plus listed versions 0.10.7-10.15.3-10.15.6-10.16.0-10.18.0-10.9.3-10.9.3-2 |
None known |
gix-datecrates.io |
0.0.0-0 up to 0.12.0 | 0.12.0 |
rust-gix-dateUbuntu:24.04:LTS |
All versions, plus listed versions 0.8.0-1 |
None known |
rust-gix-dateUbuntu:25.10 |
All versions, plus listed versions 0.9.3-1 |
None known |
rust-gix-dateUbuntu:26.10 |
All versions, plus listed versions 0.10.7-10.15.6-1 |
None known |
rust-gix-dateUbuntu:26.04:LTS |
All versions, plus listed versions 0.9.3-10.9.3-20.10.7-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-0810 is a high vulnerability (CVSS 7.1) in Gitoxidelabs Gix-date, published December 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in gix-date 0.12.0.
References
access.redhat.com/security/cve/CVE-2026-0810
bugzilla.redhat.com/show_bug.cgi?id=2427057
crates.io/crates/gix-date
github.com/GitoxideLabs/gitoxide/issues/2305
rustsec.org/advisories/RUSTSEC-2025-0140.html
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-0810
security-tracker.debian.org/tracker/CVE-2026-0810
ubuntu.com/security/CVE-2026-0810
cve.org/CVERecord?id=CVE-2026-0810