CVE-2026-91986: gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection
gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using gitoxide gix-transport versions earlier than 0.59.2 are affected when they process crafted Git URLs used for git-daemon connection requests.
What does an attacker need to exploit it?
An attacker needs to induce processing of a crafted Git URL containing NUL, carriage-return, or line-feed bytes. No privileges are required, but user interaction is required according to the supplied vector.
What can an attacker do with injected control characters?
They can inject additional NUL-delimited protocol fields to spoof virtual hosts, or inject newlines into git-daemon requests and logs. The reported impact includes low confidentiality and integrity impact.
What is the remediation?
Update gitoxide gix-transport to version 0.59.2 or later. The affected range is versions before 0.59.2.