Skip to content
OpenAdvisories
Medium ALAS2023-2026-3381 1 CVE

Moderate: rust-cargo-c security update (Amazon Linux 2023)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-82247: gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 cargo-c 0:0.10.25-1.amzn2023.0.2
Amazon Linux · 2023 cargo-c-debuginfo 0:0.10.25-1.amzn2023.0.2
Amazon Linux · 2023 rust-cargo-c-debugsource 0:0.10.25-1.amzn2023.0.2

Vulnerabilities 1

  • High 7.5
    CVE-2026-82247

    gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

    gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity…

    GitoxideLabs gitoxide rust-gix-transport rust-gix-transport Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-82247.html