CVE-2026-109350

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service (DoS) by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch process.

This vulnerability is rated as Moderate severity because exploitation requires a user or client application to interact with a malicious or untrusted remote repository, limiting the blast radius to process termination. When fetching data from such a server, malformed delta sequences trigger an unhandled crash in client-side packfile parsing without compromising host integrity or confidentiality. Under typical Red Hat deployments, the library is utilized within client-side utilities and build tooling rather than persistent network daemons, limiting the impact to interrupted operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.