CVE-2026-109350 Overview
CVE-2026-109350 is a denial-of-service vulnerability in Gitoxide gix-pack versions before 0.75.0. The flaw lets a malicious Git remote crash client fetch operations by delivering a crafted thin pack. The pack combines a REF_DELTA referencing an existing object with an OFS_DELTA whose base_distance exceeds the current pack_offset. This condition triggers a panic in LookupRefDeltaObjectsIter, aborting the fetch. The weakness is classified under [CWE-617: Reachable Assertion].
Critical Impact
Any user or automated system fetching from an untrusted remote using an affected gix-pack version can have its Git operations terminated by a reachable panic, breaking CI/CD pipelines and developer workflows.
Affected Products
- Gitoxide gix-pack crate versions before 0.75.0
- Applications and tooling embedding the vulnerable gix-pack crate
- Git clients built on the Gitoxide library performing fetch operations against untrusted remotes
Discovery Timeline
- 2026-10-12 - CVE-2026-109350 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109350
Vulnerability Analysis
The vulnerability resides in Gitoxide's pack-processing path, specifically in LookupRefDeltaObjectsIter within the gix-pack crate. Git's pack format supports two delta encodings: REF_DELTA, which references a base object by its 20-byte object ID, and OFS_DELTA, which references a base object by a negative offset from the current entry's position in the pack. During a fetch, the client receives a thin pack that may omit base objects already present locally, and the iterator must resolve delta chains before completing the transfer.
When the iterator processes an OFS_DELTA entry, it computes the base object's location as pack_offset - base_distance. The code assumes this subtraction yields a valid in-pack offset. A malicious server can send a pack where base_distance is larger than pack_offset, which would produce a negative or wrapped offset. Instead of returning an error, the implementation panics, propagating an unrecoverable abort through the fetch pipeline.
Root Cause
The root cause is a reachable assertion rather than input validation. LookupRefDeltaObjectsIter does not verify that base_distance <= pack_offset before performing the arithmetic that locates the delta base. Because the panic sits on the hot path of pack ingestion, any single malformed entry terminates the entire fetch. The preceding REF_DELTA referencing an existing object is required to reach the vulnerable iterator state.
Attack Vector
Exploitation requires an attacker-controlled Git remote and a victim that initiates a fetch, clone, or pull against it. The attacker crafts a thin pack containing an initial REF_DELTA pointing at an object the client already has, followed by an OFS_DELTA whose base_distance exceeds its own pack_offset. When the victim's Gitoxide-based client parses the pack, the iterator panics and the fetch aborts. No authentication is required beyond whatever the hosting service permits, and user interaction is limited to initiating a standard Git operation. The impact is restricted to availability; no code execution or data disclosure occurs.
Technical details are documented in the GitHub Security Advisory GHSA-mpf5-465h-mr53 and the VulnCheck Advisory on Denial of Service.
Detection Methods for CVE-2026-109350
Indicators of Compromise
- Repeated panic traces referencing LookupRefDeltaObjectsIter in logs of applications or services that embed gix-pack.
- Fetch, clone, or pull operations against external remotes terminating abnormally with non-zero exit codes and no network-layer error.
- CI/CD jobs that depend on Gitoxide-based clients failing consistently when pulling from a specific upstream remote.
Detection Strategies
- Inventory build artifacts and container images for the gix-pack crate and flag any version earlier than 0.75.0.
- Correlate process-crash telemetry on developer workstations and CI runners with outbound Git protocol connections to identify malicious remotes.
- Review Software Bill of Materials (SBOM) data for transitive dependencies on vulnerable Gitoxide releases.
Monitoring Recommendations
- Alert on repeated abnormal termination of Git client processes tied to the same remote host or repository URL.
- Monitor CI/CD platforms for recurring pack-parsing failures and investigate the originating remote.
- Track egress Git traffic from build infrastructure to untrusted or newly observed remotes.
How to Mitigate CVE-2026-109350
Immediate Actions Required
- Upgrade the gix-pack dependency to version 0.75.0 or later across all applications, services, and container images.
- Rebuild and redeploy any downstream binaries that statically link an older gix-pack.
- Restrict fetch operations in automated pipelines to vetted, trusted Git remotes until the upgrade is complete.
Patch Information
The vulnerability is resolved in Gitoxide gix-pack0.75.0. The fix adds bounds validation so that an OFS_DELTA whose base_distance exceeds pack_offset is rejected as a malformed pack entry rather than panicking. Downstream consumers must update their Cargo.toml constraints and run cargo update -p gix-pack to pull in the fixed release. Refer to the GitHub Security Advisory GHSA-mpf5-465h-mr53 for the authoritative patch reference.
Workarounds
- Limit Gitoxide-based clients to fetching only from internal, trusted Git servers until patching is complete.
- Front untrusted remotes with a known-good Git implementation that validates pack structure before handing data to downstream tooling.
- Isolate CI/CD runners that must interact with external remotes so that a crashed fetch cannot cascade into broader service disruption.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
