CVE-2026-109348: Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.
Affected Software
Event History
Frequently Asked Questions
Which operations are affected by a crafted .mailmap file?
Workers running log, blame, or shortlog can be blocked for minutes while parsing the crafted file.
What does an attacker need to do to trigger the denial of service?
The attacker needs to get a crafted .mailmap committed with descending-ordered entries. This ordering causes repeated front inserts during parsing, resulting in quadratic CPU consumption.
Are confidentiality or integrity impacts described?
No. The provided severity vector indicates no confidentiality or integrity impact; the stated effect is reduced availability through CPU exhaustion.