CVE-2026-109349

Published: Ott 12, 2026 Last Modified: Ott 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

617

Reachable Assertion

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Crash, Exit, Or Restart
Applicable Platforms
Languages: Not Language-Specific, C, Java, Rust
View CWE Details
https://github.com/GitoxideLabs/gitoxide/security/advisorie…
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwg
https://www.vulncheck.com/advisories/gix-pack-before-0.75.0…
https://www.vulncheck.com/advisories/gix-pack-before-0.75.0-reachable-assertion…