Skip to content
OpenAdvisories

Package · Ubuntu

rust-gix-transport

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.4
    CVE-2026-91986

    gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

    gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or injec…

    GitoxideLabs gitoxide rust rust-gix-transport Debian Ubuntu Azure Linux
  • Medium 6.8
    CVE-2026-82255

    gitoxide 0.25.4 HTTP Credential Leak via Redirect

    gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the o…

    GitoxideLabs gitoxide rust-gix-transport gix-transport Debian Ubuntu crates.io
  • High 7.5
    CVE-2026-82247

    gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

    gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity…

    GitoxideLabs gitoxide rust-gix-transport rust-gix-transport Debian Ubuntu
  • Medium 4.1
    CVE-2023-53158

    gix-transport code execution vulnerability

    The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult …

    GitoxideLabs gix-transport rust rust-gix-transport Ubuntu Azure Linux crates.io