CVE-2026-109348 Overview
CVE-2026-109348 is a denial of service vulnerability in Gitoxide's gix-mailmap crate before version 0.35.0. The flaw resides in Snapshot::from_bytes, where parsing performs quadratic-time work when .mailmap entries are supplied in descending order. An attacker who commits a crafted .mailmap file forces repeated front insertions during parsing, consuming CPU cycles for extended periods. Workers executing log, blame, or shortlog operations against the repository can be blocked for minutes per invocation. The vulnerability is tracked under CWE-407 Algorithmic Complexity and affects Rust-based Git tooling that depends on gix-mailmap.
Critical Impact
A crafted .mailmap committed to a repository can exhaust CPU resources on any system running Gitoxide-based log, blame, or shortlog commands, degrading build pipelines and automated code analysis workers.
Affected Products
- Gitoxide gix-mailmap crate versions prior to 0.35.0
- Rust applications and services depending on vulnerable gix-mailmap releases
- Downstream Gitoxide tooling that invokes Snapshot::from_bytes during repository operations
Discovery Timeline
- 2026-10-12 - CVE-2026-109348 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109348
Vulnerability Analysis
The vulnerability is an algorithmic complexity flaw in the .mailmap parser inside the gix-mailmap crate. Snapshot::from_bytes ingests mailmap entries and inserts them into an internal sorted structure. When entries arrive in descending order, each insertion lands at the front of the collection, forcing elements to shift and producing O(n²) runtime complexity. A .mailmap with sufficient descending-ordered entries causes parsing time to grow quadratically with input size. Operations that read mailmap data, including log, blame, and shortlog, invoke the parser and inherit the delay. Automated systems processing untrusted repositories, such as continuous integration runners and code analysis workers, can stall for minutes per request.
Root Cause
The parser lacks input-size bounds and does not use an insertion strategy with amortized logarithmic or linear cost. Repeated front insertions during ordered iteration produce the quadratic behavior described in CWE-407. The parser trusts the structure of the incoming .mailmap file without defensive limits on entry count or parse time.
Attack Vector
An attacker commits a crafted .mailmap file to a public or shared Git repository. When a victim clones or pulls the repository and runs any Gitoxide command that consults mailmap data, the parser consumes CPU cycles for an extended period. The attack requires user interaction, specifically the execution of a mailmap-aware command against the attacker-controlled content. The attack targets availability of the host process and any workers scheduled behind it.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-pmpw-wwcm-r8rc and the VulnCheck Advisory on Gitoxide DoS for technical details.
Detection Methods for CVE-2026-109348
Indicators of Compromise
- Repositories containing a .mailmap file with unusually large entry counts arranged in descending order by name or email.
- Sustained high CPU consumption by Gitoxide-based processes running log, blame, or shortlog.
- Build or analysis workers timing out on previously healthy repositories after a new commit touches .mailmap.
Detection Strategies
- Scan repositories for .mailmap files exceeding reasonable size thresholds and flag those with descending-sorted entries.
- Track execution duration of Gitoxide subcommands and alert on runs that exceed historical baselines by a wide margin.
- Inventory dependencies using cargo tree or lockfile analysis to identify services pulling gix-mailmap versions below 0.35.0.
Monitoring Recommendations
- Instrument CI runners and code intelligence workers with per-job CPU time and wall clock metrics.
- Alert on Gitoxide process runtimes that exceed a configurable timeout for log, blame, and shortlog operations.
- Log repository and commit identifiers associated with timeouts to accelerate triage of malicious contributions.
How to Mitigate CVE-2026-109348
Immediate Actions Required
- Upgrade gix-mailmap to version 0.35.0 or later in every Rust project and container image that depends on it.
- Audit transitive dependencies with cargo update -p gix-mailmap and rebuild downstream binaries.
- Apply execution timeouts to Gitoxide-driven commands in CI pipelines and automation workers.
Patch Information
The maintainers resolved the issue in gix-mailmap version 0.35.0. See the GitHub Security Advisory GHSA-pmpw-wwcm-r8rc for upgrade guidance and patch details.
Workarounds
- Reject or strip .mailmap files from untrusted repositories before invoking Gitoxide commands.
- Enforce file-size caps on .mailmap content ingested by automation workers.
- Run Gitoxide operations under process-level CPU and wall clock limits using ulimit, systemd resource controls, or container cgroup constraints.
# Configuration example: enforce CPU and wall clock limits on Gitoxide operations
timeout 30s nice -n 19 gix log --path repo/
systemd-run --scope -p CPUQuota=50% -p RuntimeMaxSec=30 gix blame file.rs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
