CVE-2026-82247: gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (canreuseidentity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gitoxide/gix-urlto a version that resolves this vulnerability.Fixed in 0.37.1 - Upgrade
Upgrade
gix-transportto a version that resolves this vulnerability.Fixed in 0.58.1
Event History
Frequently Asked Questions
Which deployments are exposed to credential disclosure?
Deployments using gix-transport with HTTP Basic credentials are exposed when an attacker can control an HTTP redirect response. The redirect can cause credentials intended for the original authority to be sent to an unintended host.
What versions need to be updated?
The affected gix-url crate is version 0.32.0 and earlier, with a fix in gitoxide 0.37.1. gix-transport is affected through version 0.49.0 and is fixed in version 0.58.1.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates no attacker privileges and no user interaction are required. However, the attacker must be able to control the redirect response used by the affected HTTP transport.