UBUNTU-CVE-2026-123533: Medium severity ubuntu/rust-gix-commitgraph vulnerability
gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to provide to trigger the issue?
The attacker needs to supply a repository containing a crafted .git/objects/info/commit-graph file. Exploitation requires a user or application to process that repository.
Which functionality can be disrupted?
The crafted commit-graph can cause panics that abort gix merge-base and gix blame. Applications embedding gix can also be affected when they process the malformed data.
Does this issue expose or alter repository data?
The provided severity vector indicates no confidentiality or integrity impact. The stated impact is denial of service through application aborts.