CVE-2026-109349

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

These are all security issues fixed in the grok-build-1.0.45+git20260929.2bdd1d6-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the openai-codex-0.162.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the stgit-2.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grok-build fixes the following issues:

Changes in grok-build:

• CVE-2026-109349: gix-pack pack version 3 header assertion failure (boo#1285155)
• CVE-2026-109350: gix-pack ofs-delta base-distance handling flaw (boo#1285155)
• CVE-2026-109351: gix-pack header object-count denial of service (boo#1285155)
• Refresh vendored Rust dependencies (gix 0.83.0 -> 0.88.0, gix-pack 0.70.0 -> 0.75.0, gix-status 0.30.0 -> 0.35.0); re-audited licences (913 external crates in the shipped graph, 1247 vendored); licence set unchanged
• adapt xai-fast-worktree to the gix 0.88 API (anyhow Context bound, from_bstr signature)

This update for stgit fixes the following issues:

Changes in stgit:

• Update to version 2.7.0:
  • Allow unambiguous command shorthands, opt-in with stgit.infer-commands.
  • Accept git approxidate spellings for dates, e.g. "2 days ago" and "@<epoch>"; relative dates are now anchored in the local time zone.
  • Run git mergetool for stg push with stgit.autoimerge.
  • Reject "@" as a branch name for stg branch --create.
  • Bump gix to 0.89 and MSRV to 1.88.
  • CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path (boo#1281742).
  • CVE-2026-109349, CVE-2026-109350, CVE-2026-109351: gix-pack denial of service via pack version 3 header, ofs-delta base distance and pack header object count (boo#1285176).