CVE-2026-109348

Executive Summary

CVE-2026-109348 is a denial-of-service vulnerability in Gitoxide's gix-mailmap crate prior to version 0.35.0. Attackers can supply a crafted .mailmap file containing descending-ordered entries, which forces repeated front insertions during parsing, resulting in quadratic-time CPU exhaustion. This flaw impacts any application or service using vulnerable versions of gix-mailmap for operations such as log, blame, or shortlog, potentially blocking worker processes for minutes and denying service to legitimate users. The vulnerability requires user interaction (e.g., processing an untrusted repository) and has a CVSS score of 4.3, reflecting low availability impact.

Technical Analysis

The vulnerability resides in the Snapshot::from_bytes function of the gix-mailmap crate, which is responsible for parsing .mailmap files. .mailmap files map author/committer names and email addresses to canonical forms in Git repositories. The parsing algorithm in vulnerable versions likely uses a data structure that supports front insertion (e.g., a Vec with insert(0, ...) or a linked list) and processes entries in the order they appear. When entries are sorted in descending order (e.g., by some key), each new entry must be inserted at the front, causing O(n) shifts for each of n entries, resulting in O(n²) time complexity. An attacker can craft a .mailmap file with a large number of entries arranged in descending order, causing the parser to consume excessive CPU cycles. This quadratic blowup can block a worker thread for minutes, depending on the number of entries and hardware. The attack surface is any Git operation that reads .mailmap files, such as gix log, gix blame, or gix shortlog, when processing an untrusted repository. The flaw is classified as CWE-407: Inefficient Algorithmic Complexity.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker identifies a service or application that uses vulnerable Gitoxide gix-mailmap for Git operations (e.g., a Git hosting platform, CI/CD pipeline, or code review tool) and processes untrusted repositories.
2. Triggering the flaw: The attacker creates a malicious Git repository containing a .mailmap file with a large number of entries sorted in descending order. The specific ordering depends on the parsing logic; the NVD description states "descending-ordered entries" trigger repeated front inserts.
3. Payload/execution method: The attacker commits the crafted .mailmap and then causes the victim application to run a Git operation (e.g., gix log, gix blame, or gix shortlog) on that repository. This could be achieved by pushing the repository to a hosting service, submitting a pull request, or tricking a user into cloning and running a command.
4. Post-exploitation impact: The parsing operation consumes excessive CPU, blocking the worker thread for minutes. If the application processes multiple such repositories or the attacker repeats the request, the service can become unresponsive, denying service to legitimate users. No data confidentiality or integrity impact is expected; only availability is affected. No public PoC is available; the attack chain is inferred from the vulnerability class and description.

Impact Assessment

The CVSS v3.1 score is 4.3 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The attack is network-exploitable with low complexity and no privileges required, but requires user interaction (e.g., the victim must process the malicious repository). The scope is unchanged, and only availability is impacted (low). Business impact includes potential downtime of Git services, CI/CD pipelines, or code analysis tools, leading to productivity loss and delayed operations. The blast radius depends on the number of concurrent users and the criticality of the affected service. Systems using Gitoxide gix-mailmap versions before 0.35.0 are affected. No evidence of active exploitation or public PoC exists, and the EPSS score is not yet available.

Detection Guidance

Sigma Rule

title: Potential Gitoxide Mailmap Denial of Service
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious .mailmap files with descending-ordered entries that may trigger quadratic parsing in Gitoxide.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.mailmap'
  condition: selection
falsepositives:
  - Legitimate .mailmap files with descending order (uncommon)
level: medium
tags:
  - attack.t1499

YARA Rule

rule CVE_2026_109348_Mailmap_DoS
{
    meta:
        description = "Detects .mailmap files with descending-ordered entries that may cause quadratic parsing in Gitoxide"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-109348"
    strings:
        $email = /<[^>]+@[^>]+>/ 
    condition:
        $email and #email > 1000
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-109348 Gitoxide Mailmap DoS Attempt"; flow:to_server,established; content:"|2e 6d 61 69 6c 6d 61 70|"; nocase; content:"|3c|"; within:100; content:"|40|"; within:100; content:"|3e|"; within:100; threshold: type both, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Elastic Detection

file where file.name == ".mailmap" and file.size > 1000000

Splunk SPL Query

index=git_logs sourcetype=git:operation command IN ("log", "blame", "shortlog") 
| rex field=repo_path "(?<mailmap>.mailmap)" 
| where mailmap != "" 
| stats count by repo_path, command 
| where count > 100

Wazuh OSSEC Rule

<rule id="100001" level="7">
    <decoded_as>json</decoded_as>
    <field name="file">\.mailmap$</field>
    <description>CVE-2026-109348: Suspicious .mailmap file detected (potential DoS)</description>
    <group>cve_2026_109348,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Avoid processing untrusted repositories with vulnerable Gitoxide versions. Implement input validation to reject .mailmap files with unusually large numbers of entries or descending order. Limit resource usage (CPU time, memory) for Git operations via cgroups or container limits. Use alternative Git implementations for critical operations until a patch is available.
2. Patch/upgrade steps: Monitor Gitoxide project for a patched version of gix-mailmap (version 0.35.0 or later expected). Once released, upgrade all dependencies to the fixed version. Since no patch is currently available, consider disabling or sandboxing affected operations.
3. Long-term hardening: Regularly update dependencies and monitor security advisories for Gitoxide. Implement algorithmic complexity checks in code reviews. Use fuzz testing to detect similar issues. Adopt a defense-in-depth approach with rate limiting and resource quotas for Git services.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109348
• Gitoxide Repository: https://github.com/Byron/gitoxide
• CWE-407: https://cwe.mitre.org/data/definitions/407.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Git Mailmap Documentation: https://git-scm.com/docs/gitmailmap

No known threat actor campaigns or exploit-in-the-wild evidence for this CVE.