Skip to content
OpenAdvisories

Package · Debian

rust-gix-transport

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.4
    CVE-2026-91986

    gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

    gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or injec…

    GitoxideLabs gitoxide rust rust-gix-transport Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-82255

    gitoxide 0.25.4 HTTP Credential Leak via Redirect

    gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the o…

    GitoxideLabs gitoxide rust-gix-transport gix-transport Debian Ubuntu crates.io
  • High 7.5
    CVE-2026-82247

    gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

    gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity…

    GitoxideLabs gitoxide rust-gix-transport rust-gix-transport Debian Ubuntu