CVE-2026-123533— Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File

Quick assessment

Affected

GitoxideLabs gitoxide

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 gitoxide 0.61.0 之前所使用的 gix-commitgraph 0.42.0 之前版本中存在一个拒绝服务（DoS）漏洞。该漏洞源于其 commit-graph 解析器未将父图位置与声明的提交数量进行校验，也未检查 EDGE 数据块的长度是否符合 4 字节对齐要求。攻击者可通过提供包含精心构造的文件的仓库，触发导致 gix merge-base、gix blame 以及嵌入 gix 的应用程序发生 panic 并异常终止。

CVSS 5.5 · Medium Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File

Source: CVE Program / CVE List V5

Vulnerability Description

gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未捕获的异常

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GitoxideLabs	gitoxide	0 ~ 0.42.0	-
GitoxideLabs	gitoxide	0 ~ 0.61.0	-

II. Public POCs for CVE-2026-123533

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123533

请登录查看更多情报信息。

Other References for CVE-2026-123533 (2)

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-989c-xj77-266r vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-before-0.42.0-denial-of-service-via-crafted-commit-graph-file third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123533

IV. Related Vulnerabilities

Same product: gitoxide

Same vendor: GitoxideLabs

Same weakness: CWE-248