CVE-2026-109351: Gitoxide gix-pack DOS Vulnerability

CVE-2026-109351 Overview

CVE-2026-109351 is an uncontrolled memory allocation vulnerability in Gitoxide gix-pack versions before 0.75.0. The flaw allows remote attackers to abort client processes by serving a crafted 12-byte pack header that declares an inflated object count. When a client invokes clone or fetch operations against a malicious remote, Tree::with_capacity attempts to pre-allocate storage for the attacker-supplied count, exhausting memory and terminating the process. The issue is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A malicious Git remote can crash any Gitoxide-based client performing a clone or fetch, disrupting developer workflows, CI/CD pipelines, and automated build systems that rely on gix-pack for Git protocol operations.

Affected Products

Gitoxide gix-pack crate versions prior to 0.75.0
Rust applications and tools embedding vulnerable gix-pack releases
CI/CD and build systems using Gitoxide for Git clone or fetch operations

Discovery Timeline

2026-10-12 - CVE-2026-109351 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109351

Vulnerability Analysis

The vulnerability resides in how gix-pack parses the fixed 12-byte Git pack header. The header contains a 4-byte object count field that the library trusts without bounds checking. A malicious remote can set this field to 0xFFFFFFFF, declaring approximately 4.29 billion objects before transmitting any pack data.

Upon receiving the header, gix-pack invokes Tree::with_capacity with the attacker-controlled count. The allocator attempts to reserve hundreds of gigabytes of contiguous memory, which fails on virtually every client system. The resulting allocation failure aborts the clone or fetch process, producing a denial-of-service condition before any object validation occurs.

Root Cause

The root cause is missing validation on the pack header's declared object count prior to allocation. The library treats a network-sourced 32-bit integer as a trustworthy capacity hint for a Tree structure, violating the principle of bounding resource allocation against attacker-controlled inputs.

Attack Vector

Exploitation requires an attacker to control or impersonate a Git remote endpoint and persuade a user or automated system to run a clone or fetch command against it. User interaction is required to initiate the connection. Once the connection is established, the 12-byte malicious header is sufficient to crash the client. See the GitHub Security Advisory and the VulnCheck Advisory on Denial of Service for protocol-level details.

// Pack header layout (12 bytes):
//   bytes 0-3: signature "PACK"
//   bytes 4-7: version (2 or 3)
//   bytes 8-11: object count (attacker sets 0xFFFFFFFF)
// Vulnerable call pattern (conceptual):
//   let count = read_u32_be(&header[8..12]);
//   let tree = Tree::with_capacity(count as usize); // unchecked allocation

Detection Methods for CVE-2026-109351

Indicators of Compromise

Unexpected process termination or SIGABRT from Gitoxide-based clients during clone or fetch
Memory allocation failures or out-of-memory kernel log entries correlated with Git network activity
CI/CD job failures referencing gix-pack during repository synchronization against untrusted remotes

Detection Strategies

Inventory Rust binaries and services that depend on gix-pack and flag versions earlier than 0.75.0
Monitor outbound Git protocol connections from build agents and developer endpoints to non-approved hosts
Alert on repeated client crashes tied to Git operations within short time windows

Monitoring Recommendations

Collect process exit codes and crash telemetry from CI/CD runners performing clone or fetch
Capture resource utilization spikes on build hosts during Git transport, including virtual memory reservation attempts
Log the remote URLs targeted by clone and fetch commands to support post-incident attribution

How to Mitigate CVE-2026-109351

Immediate Actions Required

Upgrade all dependencies on gix-pack to version 0.75.0 or later and rebuild downstream Rust binaries
Audit CI/CD pipelines and developer tooling for transitive dependencies on vulnerable Gitoxide crates
Restrict clone and fetch operations to trusted, authenticated Git remotes until patching is complete

Patch Information

The fix is included in Gitoxide gix-pack version 0.75.0. The upstream patch enforces a bounded capacity when allocating the object Tree, preventing attacker-controlled header fields from driving large allocations. Refer to the GitHub Security Advisory GHSA-x862-c2wj-4mwr for the authoritative patch reference.

Workarounds

Pin gix-pack to 0.75.0 or later in Cargo.toml and verify through cargo tree
Block egress from build systems to unknown Git hosts and permit only reviewed repository endpoints
Apply per-process memory limits (for example, ulimit -v or systemd MemoryMax) to contain allocation attempts

bash

# Enforce the fixed version in Cargo.toml
# [dependencies]
# gix-pack = ">=0.75.0"
cargo update -p gix-pack
cargo tree -i gix-pack | grep -v "0.7[5-9]\|0.[89]\|^[1-9]"