Remote Assertion Vulnerability in gitoxide gix-pack Product by Gitoxide

CVE-2026-109349

What is CVE-2026-109349?

The gix-pack component of gitoxide prior to version 0.75.0 contains a vulnerability that allows a malicious actor to trigger a denial of service. By sending a specially crafted 12-byte pack header indicating version 3, an attacker can exploit a reachable assertion, causing the client to panic and abort operations such as clone or fetch. This vulnerability raises significant concerns for users relying on the functionality provided by gix-pack and emphasizes the importance of keeping software updated to mitigate such risks.

References