CVE-2026-123533 Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123533?
CVE-2026-123533 is a medium-severity vulnerability in GitoxideLabs gitoxide, published on 8 Nov 2026.
Official description
gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix.
Weakness: CWE-248
Which versions are affected by CVE-2026-123533?
How do I fix CVE-2026-123533?
No fix has been published for CVE-2026-123533 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123533 being exploited?
There is no known exploitation of CVE-2026-123533 in the wild and no public exploit code.
Sources
Also known as AZL-113263, AZL-113284, DEBIAN-CVE-2026-123533, GHSA-5h7f-ghvg-967h, GHSA-989c-xj77-266r, UBUNTU-CVE-2026-123533.