Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-109351 →

UBUNTU-CVE-2026-109351

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplyin...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:26.10 rust-gix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS rust-gix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

report ubuntu.com
report cve.org
report github.com
report vulncheck.com