CVE-2026-123533 · Package
NO FIX YET · SEE WHAT TO DO
gix-commitgraph, the commit-graph parser in the gitoxide Rust Git library, does not validate parent positions or EDGE chunk alignment. A crafted .git/objects/info/commit-graph file makes gix commands and applications embedding gix panic and abort, which denies service.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only applications that use gitoxide or gix-commitgraph to read repositories are exposed, and the trigger is a repository containing a malicious commit-graph file, so tools that clone or open untrusted repositories are the main risk. Teams that only run the git CLI or never open untrusted repositories with gix can skip it. unknown for any other exposure detail.
Not affected if git-cli-only, trusted-repos-only
Who cares git-tooling, gitoxide, gix-commitgraph, rust
gix --version or the gix-commitgraph version in Cargo.lockgix-commitgraph and gitoxide entries below 0.42.0 and 0.61.0gix-commitgraph 0.42.0gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
gitoxide 0.61.0