CVE-2026-109349 gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
A malicious remote can cause a client panic and abort clone or fetch operations by sending a crafted pack header, affecting Gitoxide users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-109349?
CVE-2026-109349 is a high-severity denial of service vulnerability in GitoxideLabs gix-pack, published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.
Weakness: CWE-617
Which versions are affected by CVE-2026-109349?
How do I fix CVE-2026-109349?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-109349 being exploited?
There is no known exploitation of CVE-2026-109349 in the wild and no public exploit code.
Sources
Also known as AZL-108084, AZL-108087, DEBIAN-CVE-2026-109349, GHSA-633h-mqjc-8rwg, GHSA-wmw6-cp8f-c6q8, UBUNTU-CVE-2026-109349.