CVE-2026-109351

A flaw was found in the gix-pack component of Gitoxide. A malicious remote repository can cause a Denial of Service (DoS) by providing a crafted pack header with an excessively large object count during clone or fetch operations. This forces the client to attempt an uncontrolled memory allocation, exhausting system resources and crashing the process.

This vulnerability is rated Moderate rather than Important because exploitation requires user interaction to connect to a malicious remote repository and only results in a denial of service. When handling a crafted pack header, affected applications using the gix-pack library attempt excessive memory allocation, causing the process to abort. The issue is restricted to crashing the active client operation, with no compromise to data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.