CVE-2026-109351: Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to reserve hundreds of gigabytes and crash clone or fetch operations.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use gix-pack before 0.75.0 and perform clone or fetch operations against a malicious remote are exposed. The affected operation can be triggered by a remote server supplying a crafted pack header.
Does exploitation require authentication or user interaction?
The supplied vector indicates no attacker privileges are required, but user interaction is required. In practice, a clone or fetch operation must be initiated against the malicious remote.
What happens during an attempted exploit?
A malicious remote can advertise a pack header with an object count of 0xFFFFFFFF. This causes Tree::with_capacity to attempt to reserve hundreds of gigabytes of memory, potentially aborting the process and disrupting the clone or fetch operation.
What version should be used to address the issue?
Upgrade gix-pack to version 0.75.0 or later. Versions before 0.75.0 are identified as affected.