CVE-2026-109349: gitoxide gix-pack DOS Vulnerability

CVE-2026-109349 Overview

CVE-2026-109349 is a reachable assertion vulnerability [CWE-617] in the gix-pack crate of gitoxide, a pure Rust implementation of Git. Versions before 0.75.0 contain an inconsistency in BytesToEntriesIter::new_from_header, where the pack header decoder accepts version 3 while a release-enabled assert_eq! macro requires version 2. A malicious remote server can transmit a 12-byte pack header declaring version 3, triggering a panic in the client and aborting any in-progress clone or fetch operation.

Critical Impact
Any gitoxide-based client performing a clone or fetch from an attacker-controlled remote can be forcibly terminated through a crafted pack header, disrupting automated Git workflows and CI/CD pipelines.

Affected Products

gitoxide gix-pack crate versions prior to 0.75.0
Rust applications depending on vulnerable gix-pack releases
CI/CD and tooling built on gitoxide for Git operations

Discovery Timeline

2026-10-12 - CVE-2026-109349 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109349

Vulnerability Analysis

The defect resides in BytesToEntriesIter::new_from_header, the function responsible for decoding the 12-byte header of a Git pack file. The header decoder permits pack format version 3, but a subsequent assert_eq! call enforces version 2. Because assert_eq! remains active in release builds, the mismatch forces a panic rather than returning a recoverable error.

An attacker running a hostile Git server can emit a pack stream whose header declares version 3. When a gitoxide client processes this header during a clone or fetch, the assertion fails and the process aborts. The condition requires user-initiated interaction with the malicious remote.

Root Cause

The root cause is inconsistent input validation between two layers of the parser. The header parser considers version 3 syntactically valid, while the invariant check downstream permits only version 2. The use of a hard assertion instead of structured error handling converts a protocol-level anomaly into a process-terminating panic.

Attack Vector

Exploitation requires network access and user action, specifically a git clone or git fetch against an attacker-controlled repository or a man-in-the-middle on an unauthenticated transport. No authentication or elevated privileges are required on the client. The impact is limited to availability. No code execution, memory corruption, or data disclosure results from the panic.

Technical details are documented in the GitHub Security Advisory GHSA-633h-mqjc-8rwg and the VulnCheck advisory for gix-pack.

Detection Methods for CVE-2026-109349

Indicators of Compromise

Unexpected panics or process aborts in gitoxide-based clients during clone or fetch operations.
Rust panic messages referencing BytesToEntriesIter::new_from_header or assert_eq! failures tied to pack version mismatches.
Interrupted CI/CD jobs that terminate immediately after initiating a Git fetch from an external remote.

Detection Strategies

Inventory Rust projects and binaries for dependencies on gix-pack versions earlier than 0.75.0 using cargo tree or SBOM tooling.
Scan Git transport logs for repeated client aborts correlated with the same remote endpoint.
Review package manifests (Cargo.lock) across build systems to confirm the resolved version of gix-pack.

Monitoring Recommendations

Alert on abnormal exit codes from Git tooling in automated pipelines where gitoxide is the client implementation.
Monitor outbound Git traffic to untrusted or newly observed hosts initiated by build agents.
Capture stderr from Git clients in CI logs to retain panic traces for forensic review.

How to Mitigate CVE-2026-109349

Immediate Actions Required

Upgrade the gix-pack dependency to version 0.75.0 or later in all Rust projects and downstream binaries.
Rebuild and redeploy any application, CLI tool, or container image that bundles a vulnerable gix-pack release.
Restrict clone and fetch operations in automated workflows to vetted, trusted Git remotes until patching is complete.

Patch Information

The gitoxide maintainers released gix-pack0.75.0 to resolve the reachable assertion. Consumers should update their Cargo.toml manifests, regenerate Cargo.lock, and rebuild. Refer to the GitHub Security Advisory GHSA-633h-mqjc-8rwg for the fix commit and affected version ranges.

Workarounds

Avoid cloning or fetching from untrusted remote repositories with gitoxide-based tooling until the dependency is updated.
Route Git traffic through authenticated internal mirrors that only serve validated pack streams.
Where feasible, substitute the canonical git client for sensitive operations until gitoxide consumers are patched.

bash

# Update gix-pack in a Rust project
cargo update -p gix-pack --precise 0.75.0
cargo build --release