CVE-2026-109350— Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance
Quick assessment
Affected
GitoxideLabs gix-pack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 gix-pack 0.75.0 之前的版本中存在一个拒绝服务漏洞，允许恶意远程服务器通过发送精心构造的薄包（thin-pack）中的 OFS_DELTA 条目来导致拉取操作崩溃。攻击者可以提供一个薄包，其中包含一个对已存在对象的 REF_DELTA 引用，随后是一个 base_distance 超出 pack_offset 的 OFS_DELTA，从而在 LookupRefDeltaObjectsIter 中触发 panic，并中止拉取过程。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| GitoxideLabs | gix-pack | < 0.75.0 |
affected |
0.75.0 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance
Source: CVE Program / CVE List V5
Vulnerability Description
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GitoxideLabs | gix-pack | 0 ~ 0.75.0 | - |
|
II. Public POCs for CVE-2026-109350
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109350
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109350 (2)
Same Patch Batch · GitoxideLabs · 2026-10-12 · 4 CVEs total
| CVE-2026-109351 | 6.5 MEDIUM | Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count |
| CVE-2026-109349 | 6.5 MEDIUM | gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header |
| CVE-2026-109348 | 4.3 MEDIUM | Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing |
IV. Related Vulnerabilities
Same vendor: GitoxideLabs
-
CVE-2026-109351
Gitoxide gix-pack before 0.75.0 Denial of Service via Pack H -
CVE-2026-109349
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Vers -
CVE-2026-109348
Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via -
CVE-2026-100419
gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink -
CVE-2026-91986
gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection
Same weakness: CWE-617
-
CVE-2026-104005
Incorrect authorization in MongoDB Server router for bulk wr -
CVE-2026-96299
Missing Authorization Check on Internal Aggregation Stage in -
CVE-2026-109946
FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 -
CVE-2026-109944
FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Sm -
CVE-2026-109678
FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Em
V. Comments for CVE-2026-109350
No comments yet