Uncontrolled Memory Allocation in Gitoxide gix-pack Affects Remote Operations

CVE-2026-109351

What is CVE-2026-109351?

The gix-pack component of Gitoxide prior to version 0.75.0 is susceptible to an uncontrolled memory allocation flaw. This vulnerability can be exploited by remote attackers who provide an oversized pack-header object count, potentially leading to denial of service. By manipulating the pack header to report an unrealistic number of objects, malicious actors can compel the Tree::with_capacity process to allocate an excessive amount of memory, resulting in significant disruptions during clone or fetch operations.

References