Description
gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitoxideLabs | gitoxide | < 0.42.0, < 0.61.0 | 0.42.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-gix-commitgraph | No fix yet | — |
| Debian 13 | rust-gix-commitgraph | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-gix-commitgraph | No fix yet | — |
| Ubuntu 26.04 LTS | rust-gix-commitgraph | No fix yet | — |
| Ubuntu 24.04 LTS | rust-gix-commitgraph | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rust | No fix yet | — |
References
- GitHub Security Advisory (GHSA-989c-xj77-266r) vendor-advisory
- VulnCheck Advisory: Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File third-party-advisory