CVE-2026-109351: Gitoxidelabs Gix-Pack

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

Affected products

• Gitoxidelabs Gix-Pack: before 0.75.0 (fixed in 0.75.0)

Published 2026-10-12. Last modified 2026-10-16.