CVE-2026-109348

CVSS 5.3 (medium) · published 2026-10-12

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.

Weakness: CWE-407

Source: NVD CVE-2026-109348

References

• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmpw-wwcm-r8rc
• https://www.vulncheck.com/advisories/gitoxide-gix-mailmap-before-0.35.0-cpu-denial-of-service-via-mailmap-parsing
• https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmpw-wwcm-r8rc

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.