CVE-2026-123533
Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.
| CWE | CWE-248 |
| Vendor | gitoxidelabs |
| Product | gitoxide |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitoxidelabs gitoxide
Be the first to know when new medium vulnerabilities affecting gitoxidelabs gitoxide are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
GitoxideLabs / gitoxide
0 < 0.42.0
GitoxideLabs / gitoxide
0 < 0.61.0
References
Credits
🔍 Hama1cco