CVE-2026-109349

A flaw was found in gix-pack. A malicious remote server can trigger a Denial of Service (DoS) by returning a crafted pack header declaring version 3 during a repository clone or fetch operation. Because the header decoder triggers an internal assertion failure when encountering this version, the client application crashes immediately, terminating the operation.

This vulnerability is rated as Moderate severity because exploitation results solely in a denial of service by terminating the client process, without compromising system integrity or exposing confidential data. Triggering the crash requires user interaction, specifically initiating a fetch or clone operation against an untrusted or compromised remote Git server. Within Red Hat environments, bundled utilities embedding this library are primarily utilized as developer tooling and command-line operations, restricting the failure impact to the active transaction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.