CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

These are all security issues fixed in the grok-build-1.0.45+git20260929.2bdd1d6-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the openai-codex-0.162.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for grok-build fixes the following issues:

Changes in grok-build:

• CVE-2026-109349: gix-pack pack version 3 header assertion failure (boo#1285155)
• CVE-2026-109350: gix-pack ofs-delta base-distance handling flaw (boo#1285155)
• CVE-2026-109351: gix-pack header object-count denial of service (boo#1285155)
• Refresh vendored Rust dependencies (gix 0.83.0 -> 0.88.0, gix-pack 0.70.0 -> 0.75.0, gix-status 0.30.0 -> 0.35.0); re-audited licences (913 external crates in the shipped graph, 1247 vendored); licence set unchanged
• adapt xai-fast-worktree to the gix 0.88 API (anyhow Context bound, from_bstr signature)

This update for stgit fixes the following issues:

Changes in stgit:

• Update to version 2.7.0:
  • Allow unambiguous command shorthands, opt-in with stgit.infer-commands.
  • Accept git approxidate spellings for dates, e.g. "2 days ago" and "@<epoch>"; relative dates are now anchored in the local time zone.
  • Run git mergetool for stg push with stgit.autoimerge.
  • Reject "@" as a branch name for stg branch --create.
  • Bump gix to 0.89 and MSRV to 1.88.
  • CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path (boo#1281742).
  • CVE-2026-109349, CVE-2026-109350, CVE-2026-109351: gix-pack denial of service via pack version 3 header, ofs-delta base distance and pack header object count (boo#1285176).