Source: rust-gix-commitgraph Version: 0.41.0-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for rust-gix-commitgraph. CVE-2026-123533[0]: | gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, | contains a denial of service vulnerability because its commit-graph | parser does not validate parent graph positions against the declared | commit count or check the EDGE chunk length for 4-byte alignment. | Attackers can supply a repository containing a crafted | .git/objects/info/commit-graph file to trigger panics that abort gix | merge-base, gix blame, and applications embedding gix. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-123533 https://www.cve.org/CVERecord?id=CVE-2026-123533 [1] https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-989c-xj77-266r Please adjust the affected versions in the BTS as needed. Regards, Salvatore
