Every CVE Search/ Get API key

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

7.1 HighFix available

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.32%Up 0.1 points since Oct 13, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
CVE-2026-109350
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
EUVDEUVD-2026-97652 7.1

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
EUVD-2026-97652
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-86jp-9qq8-2gwc 7.1

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious...

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
GHSA-86jp-9qq8-2gwc
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
NVD 7.1

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
CVE-2026-109350
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
OSV 7.1

Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
CVE-2026-109350
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-617
Updated
2026-11-02
OSVDEBIAN-CVE-2026-109350 7.1

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
DEBIAN-CVE-2026-109350
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 7 moreShow less
OSVRHSA-2026:83849 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:83849
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:83879 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:83879
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-109350 7.1

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Record
UBUNTU-CVE-2026-109350
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:12141-1 No score

grok-build-1.0.45+git20260929.2bdd1d6-2.1 on GA media

These are all security issues fixed in the grok-build-1.0.45+git20260929.2bdd1d6-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12141-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12144-1 No score

openai-codex-0.162.1-2.1 on GA media

These are all security issues fixed in the openai-codex-0.162.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12144-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22130-1 No score

Security update for grok-build

This update for grok-build fixes the following issues:

Changes in grok-build:

  • CVE-2026-109349: gix-pack pack version 3 header assertion failure (boo#1285155)
  • CVE-2026-109350: gix-pack ofs-delta base-distance handling flaw (boo#1285155)
  • CVE-2026-109351: gix-pack header object-count denial of service (boo#1285155)
  • Refresh vendored Rust dependencies (gix 0.83.0 -> 0.88.0, gix-pack 0.70.0 -> 0.75.0, gix-status 0.30.0 -> 0.35.0); re-audited licences (913 external crates in the shipped graph, 1247 vendored); licence set unchanged
  • adapt xai-fast-worktree to the gix 0.88 API (anyhow Context bound, from_bstr signature)
Record
openSUSE-SU-2026:22130-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22204-1 No score

Security update for stgit

This update for stgit fixes the following issues:

Changes in stgit:

  • Update to version 2.7.0:
    • Allow unambiguous command shorthands, opt-in with stgit.infer-commands.
    • Accept git approxidate spellings for dates, e.g. "2 days ago" and "@<epoch>"; relative dates are now anchored in the local time zone.
    • Run git mergetool for stg push with stgit.autoimerge.
    • Reject "@" as a branch name for stg branch --create.
    • Bump gix to 0.89 and MSRV to 1.88.
    • CVE-2026-91986: gix-transport CR/LF/NUL injection into git-daemon connect request via crafted git URL path (boo#1281742).
    • CVE-2026-109349, CVE-2026-109350, CVE-2026-109351: gix-pack denial of service via pack version 3 header, ofs-delta base distance and pack header object count (boo#1285176).
Record
openSUSE-SU-2026:22204-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rust-gix-pack
Debian:13
 All versions, plus listed versions
0.56.0-10.60.0-10.70.0-10.73.0-10.73.0-20.74.2-10.76.0-1
 None known
rust-gix-pack
Debian:14
 All versions, plus listed versions
0.56.0-10.60.0-10.70.0-10.73.0-10.73.0-20.74.2-10.76.0-1
 None known
cargo
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
clippy
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-analyzer
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-debugger-common
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-doc
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-gdb
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-lldb
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
Show 36 moreShow less
Affected packages
PackageAffectedFixed
rust-src
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
rustfmt
Red Hat:hummingbird:1
 before 0:1.99.0-1.1.hum1
0:1.99.0-1.1.hum1
cargo
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
clippy
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-analyzer
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-debugger-common
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-doc
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-gdb
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-lldb
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-src
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rustfmt
Red Hat:hummingbird:1
 before 0:1.99.1-1.1.hum1
0:1.99.1-1.1.hum1
rust-gix
Ubuntu:26.10
 All versions, plus listed versions
0.73.0-10.83.0-2
 None known
rust-gix
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.69.1-10.69.1-20.73.0-10.73.0-1build1
 None known
grok-build
openSUSE:Tumbleweed
 before 1.0.45+git20260929.2bdd1d6-2.1
1.0.45+git20260929.2bdd1d6-2.1
openai-codex
openSUSE:Tumbleweed
 before 0.162.1-2.1
0.162.1-2.1
grok-build
openSUSE:Leap 16.0
 before 1.0.45+git20260929.2bdd1d6-bp160.2.1
1.0.45+git20260929.2bdd1d6-bp160.2.1
stgit
openSUSE:Leap 16.0
 before 2.7.0-bp160.1.1
2.7.0-bp160.1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-109350 is a high vulnerability (CVSS 7.1) in Gitoxidelabs Gix-pack, published October 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in cargo 0:1.99.0-1.1.hum1.

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open