CVE-2026-123533 Details
Description
gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.
A denial-of-service vulnerability has been identified in gix-commitgraph versions prior to 0.42.0, as well as in gitoxide versions prior to 0.61.0. The issue arises because the commit-graph parser in gix-commitgraph does not properly validate parent graph positions against the declared commit count or ensure that the EDGE chunk length is 4-byte aligned. This oversight allows attackers to introduce a repository with a manipulated .git/objects/info/commit-graph file, causing gix commands that traverse commit history, such as gix merge-base and gix blame, to panic and abort. Additionally, applications that embed gix can experience similar process termination.
Users can upgrade to gitoxide version 0.61.0 or gix-commitgraph version 0.42.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-989c-xj77-266r | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/gitoxide-before-0.42.0-denial-of-service-via-crafted-commit-graph-file | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GitoxideLabs gix-commitgraph | <= 0.41.0 (semver) < 0.42.0 (semver) |
CPE
Remediation
| |
| GitoxideLabs gitoxide | < 0.61.0 (semver) <= 0.60.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |