CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
An attacker can leak HTTP Basic credentials to an unintended host by exploiting a URL parsing flaw in gitoxide's gix-url crate during redirects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82247?
CVE-2026-82247 is a high-severity vulnerability in GitoxideLabs gitoxide, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).
Weakness: CWE-522
Which versions are affected by CVE-2026-82247?
How do I fix CVE-2026-82247?
Upgrade to a fixed version.
Is CVE-2026-82247 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82247 exists.
Sources
Also known as DEBIAN-CVE-2026-82247, GHSA-c828-8g79-fpj5, GHSA-jrcm-326h-gpp8, UBUNTU-CVE-2026-82247.