{"id":"CVE-2026-123533","kind":"vulnerability","aliases":["CVE-2026-123533"],"related":[],"title":"gitoxide: crafted commit-graph file crashes gix-commitgraph parser","description":"gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.","summary":"gix-commitgraph, the commit-graph parser in the gitoxide Rust Git library, does not validate parent positions or EDGE chunk alignment. A crafted .git/objects/info/commit-graph file makes gix commands and applications embedding gix panic and abort, which denies service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git-tooling","gitoxide","gix-commitgraph","package","rust"],"not_affected_if":["git-cli-only","trusted-repos-only"],"how_to_check":"- Check the gitoxide version with `gix --version` or the `gix-commitgraph` version in Cargo.lock\n- Search Cargo.lock for `gix-commitgraph` and `gitoxide` entries below `0.42.0` and `0.61.0`","fix":"- `gix-commitgraph` `0.42.0`\n- `gitoxide` `0.61.0`","status":"open","published_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","triaged_at":"2026-11-08T02:24:48+00:00","updated_at":"2026-11-08T02:24:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:48Z","model":"claude-haiku-5-5","output":{"fix":"- `gix-commitgraph` `0.42.0`\n- `gitoxide` `0.61.0`","reach":"local","title":"gitoxide: crafted commit-graph file crashes gix-commitgraph parser","impact":"low","summary":"gix-commitgraph, the commit-graph parser in the gitoxide Rust Git library, does not validate parent positions or EDGE chunk alignment. A crafted .git/objects/info/commit-graph file makes gix commands and applications embedding gix panic and abort, which denies service.","audience":"developers","category":"package","nicknames":[],"who_cares":["gitoxide","gix-commitgraph","rust","git-tooling"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Process aborts on crafted repository, causing denial of service","analyst_note":"","how_to_check":"- Check the gitoxide version with `gix --version` or the `gix-commitgraph` version in Cargo.lock\n- Search Cargo.lock for `gix-commitgraph` and `gitoxide` entries below `0.42.0` and `0.61.0`","plain_action":"","needs_analyst":false,"not_affected_if":["git-cli-only","trusted-repos-only"],"who_is_affected":"Only applications that use gitoxide or gix-commitgraph to read repositories are exposed, and the trigger is a repository containing a malicious commit-graph file, so tools that clone or open untrusted repositories are the main risk. Teams that only run the git CLI or never open untrusted repositories with gix can skip it. unknown for any other exposure detail.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4324,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123533':14A,17A '-2026':13A,16A '0.42.0':71C '0.61.0':77C '4':108C 'abort':63B,125C 'align':49B,110C 'applic':58B,133C 'attack':111C 'base':129C 'blame':131C 'byte':109C 'check':102C 'chunk':48B,105C 'command':56B 'commit':4A,32B,87C,99C 'commit-graph':3A,31B,86C 'commitgraph':10A,24B,29B,69C 'contain':78C,116C 'count':100C 'craft':2A,51B,118C 'crash':7A 'cve':12A,15A 'declar':98C 'deni':65B 'denial':80C 'edg':47B,104C 'embed':59B,134C 'file':6A,53B,120C 'git':19B,39B 'git-tool':18B 'git/objects/info/commit-graph':52B,119C 'gitoxid':1A,21B,37B,75C 'gix':9A,23B,28B,55B,60B,68C,126C,130C,135C 'gix-commitgraph':8A,22B,27B,67C 'graph':5A,33B,88C,94C 'length':106C 'librari':40B 'make':54B 'merg':128C 'merge-bas':127C 'packag':25B 'panic':61B,123C 'parent':44B,93C 'parser':11A,34B,89C 'posit':45B,95C 'repositori':115C 'rust':26B,38B 'servic':66B,82C 'suppli':113C 'tool':20B 'trigger':122C 'use':73C 'valid':43B,92C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use gitoxide or gix-commitgraph to read repositories are exposed, and the trigger is a repository containing a malicious commit-graph file, so tools that clone or open untrusted repositories are the main risk. Teams that only run the git CLI or never open untrusted repositories with gix can skip it. unknown for any other exposure detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gitoxide","gittooling","gixcommitgraph","medium","package","rust"],"campaign_type":null,"search_a":"'-123533':14A,17A '-2026':13A,16A 'commit':4A 'commit-graph':3A 'commitgraph':10A 'craft':2A 'crash':7A 'cve':12A,15A 'file':6A 'gitoxid':1A 'gix':9A 'gix-commitgraph':8A 'graph':5A 'parser':11A","search_b":"'abort':63B 'align':49B 'applic':58B 'chunk':48B 'command':56B 'commit':32B 'commit-graph':31B 'commitgraph':24B,29B 'craft':51B 'deni':65B 'edg':47B 'embed':59B 'file':53B 'git':19B,39B 'git-tool':18B 'git/objects/info/commit-graph':52B 'gitoxid':21B,37B 'gix':23B,28B,55B,60B 'gix-commitgraph':22B,27B 'graph':33B 'librari':40B 'make':54B 'packag':25B 'panic':61B 'parent':44B 'parser':34B 'posit':45B 'rust':26B,38B 'servic':66B 'tool':20B 'valid':43B","search_c":"'0.42.0':71C '0.61.0':77C '4':108C 'abort':125C 'align':110C 'applic':133C 'attack':111C 'base':129C 'blame':131C 'byte':109C 'check':102C 'chunk':105C 'commit':87C,99C 'commit-graph':86C 'commitgraph':69C 'contain':78C,116C 'count':100C 'craft':118C 'declar':98C 'denial':80C 'edg':104C 'embed':134C 'file':120C 'git/objects/info/commit-graph':119C 'gitoxid':75C 'gix':68C,126C,130C,135C 'gix-commitgraph':67C 'graph':88C,94C 'length':106C 'merg':128C 'merge-bas':127C 'panic':123C 'parent':93C 'parser':89C 'posit':95C 'repositori':115C 'servic':82C 'suppli':113C 'trigger':122C 'use':73C 'valid':92C 'vulner':83C","first_public_at":"2026-10-22T14:01:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123533","severity":null,"published_at":"2026-11-08T02:16:43+00:00","modified_at":"2026-11-08T02:16:43+00:00","first_seen_at":"2026-11-08T02:21:10+00:00","fetched_at":"2026-11-08T02:21:10+00:00","note":null}],"documents":[{"id":99215,"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-989c-xj77-266r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T14:01:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99216,"url":"https://www.vulncheck.com/advisories/gitoxide-before-0.42.0-denial-of-service-via-crafted-commit-graph-file","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}