Medium severity6.5NVD Advisory· Published Oct 12, 2026

CVE-2026-109349

Description

gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.

Affected products

Gitoxide/Gitoxidellm-fuzzy
Range: <0.75.0
Gitoxide/gix-packllm-create
Range: <0.75.0

Patches

Vulnerability mechanics

References

github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwgnvd
www.vulncheck.com/advisories/gix-pack-before-0.75.0-reachable-assertion-dos-via-pack-version-3-headernvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000