CVE-2026-109350

Executive Summary

CVE-2026-109350 is a denial-of-service vulnerability in the Gitoxide gix-pack crate affecting versions prior to 0.75.0. A malicious Git remote can serve a crafted thin pack that triggers a panic in the LookupRefDeltaObjectsIter component, aborting the fetch operation. The vulnerability requires user interaction (a fetch initiated by the victim) and impacts availability only, with a CVSS 3.1 base score of 6.5.

Technical Analysis

Git thin packs are a bandwidth optimization in the Git wire protocol: a packfile may reference objects already present on the receiving side instead of transmitting their full content. Two relevant delta encodings exist in this context:

• REF_DELTA: a delta whose base object is identified by its object ID (SHA-1/SHA-256 hash). In a thin pack, this base object may already exist in the recipient's local object database rather than inside the pack file itself.
• OFS_DELTA: a delta whose base object is located at a specified negative offset (base_distance) preceding the delta object within the same packfile stream. The base offset is computed as pack_offset - base_distance.

The NVD description states that a malicious remote can serve a thin pack containing a REF_DELTA that references an existing object, followed by an OFS_DELTA whose base_distance exceeds pack_offset. Because pack_offset - base_distance underflows when the delta is applied to a thin pack where referenced bases are resolved externally, the object lookup performed by LookupRefDeltaObjectsIter encounters an invalid state and panics.

This is the code-level defect pattern classified as CWE-617 (Reachable Assertion). A panic in Rust is typically implemented via assertion or an explicit panic!/unwrap/expect path; the description explicitly identifies LookupRefDeltaObjectsIter as the panic site. The "Reachable Assertion" classification means the precondition the code assumes — that base_distance never exceeds the current pack offset — is not validated before use, and malformed remote input violates it.

Attack surface: any Gitoxide-based client performing fetch/clone against an untrusted remote. The trigger requires the victim to initiate a fetch (UI:R) but no credentials or privileges on the attacker side (PR:N) and no network position privileges (AV:N). The panic aborts the fetch process; because Gitoxide is a library, the abort semantics propagate to the consuming application. Depending on how the calling application handles the panic, the operational effect ranges from a failed fetch to a crashed process.

Notably, the CVE summary does not describe memory corruption, code execution, or data disclosure — integrity and confidentiality sub-scores are N, and only availability is High. The exploit primitive is entirely within the packfile parsing/ingestion pipeline and terminates the fetch routine.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-109350; the attack chain below is inferred from the vulnerability class and NVD description. No specific function names, endpoints, or parameters beyond those named in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies clients that use Gitoxide-based tooling (gix, applications embedding the gix-pack crate, or third-party tools depending on it) to fetch from untrusted or attacker-controlled remotes. This could be a public repository, a dependency mirror, or any remote the victim is induced to fetch from.

2. Triggering the flaw class. The attacker crafts a thin pack server response that includes, in order: a REF_DELTA whose base is an object the victim already has locally (so the delta resolves against local state), followed by an OFS_DELTA whose declared base_distance is greater than the offset of that delta object within the pack. When the victim initiates a fetch, the client parses the pack and reaches LookupRefDeltaObjectsIter, where the invalid base offset is not rejected.

3. Payload / execution. No code payload is required. The packfile itself is the weapon: it is served by the attacker's Git remote over the standard fetch negotiation. The malformed OFS_DELTA metadata drives the object-lookup iterator into an unreachable state, causing the Rust panic identified in the CVE.

4. Post-exploitation impact. The panic aborts the fetch process. If the consuming application does not isolate the panic, the process may terminate entirely, constituting denial of service against the fetching endpoint. There is no persistence, lateral movement, or data exfiltration associated with this issue as described; the impact is confined to availability of the fetch/build/CI operation.

Impact Assessment

CVSS 3.1 base score: 6.5 (Medium). Sub-scores:

• Attack Vector: Network (AV:N) — the malicious content is delivered over the Git transport protocol.
• Attack Complexity: Low (AC:L) — the crafted pack requires no specialized conditions beyond knowing a locally present object for the REF_DELTA base.
• Privileges Required: None (PR:N) — no access to the target system is needed.
• User Interaction: Required (UI:R) — the victim must initiate the fetch against the malicious remote.
• Scope: Unchanged (S:U) — the vulnerability does not affect components beyond the fetch parsing path.
• Confidentiality: None (C:N), Integrity: None (I:N), Availability: High (A:H) — the sole impact class is availability.

Business impact concentrates in build pipelines, CI/CD jobs, and automated tooling that depend on cloning or fetching from untrusted remotes using Gitoxide-based clients. A panic that aborts the fetch can fail a pipeline run; if the embedding process crashes, the effect expands to whatever service hosts it. Because EPSS is not yet scored by FIRST.org and the issue is absent from CISA KEV, observed exploitation is currently unknown, but the low complexity and network vector make it attractive for nuisance-level supply-chain disruption.

Detection Guidance

Sigma Rule

title: Gitoxide gix-pack Panic via Malformed Thin-Pack OFS_DELTA
id: 9f3c1ab0-4d8e-4c2a-9b1f-0000gixpack01
status: experimental
description: Detects panic/abort messages from gix-pack when processing crafted thin-pack OFS_DELTA entries (CVE-2026-109350)
logsource:
  product: linux
  service: application
detection:
  selection_panic:
    - "LookupRefDeltaObjectsIter"
    - "panicked at"
  selection_context:
    - "gix-pack"
    - "gix_pack"
    - "base_distance"
    - "OFS_DELTA"
  condition: selection_panic and selection_context
falsepositives:
  - Legitimate corrupt packfiles from non-malicious sources
level: medium

YARA Rule

rule CVE_2026_109350_GixPack_ThinPack_DoS
{
    meta:
        description = "Detects gix-pack LookupRefDeltaObjectsIter panic strings associated with crafted thin-pack OFS_DELTA handling (CVE-2026-109350)"
        cve = "CVE-2026-109350"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109350"
        severity = "medium"
    strings:
        $p1 = "LookupRefDeltaObjectsIter" ascii wide
        $p2 = "gix-pack" ascii wide
        $p3 = "gix_pack" ascii wide
        $p4 = "base_distance" ascii wide
        $p5 = "OFS_DELTA" ascii
        $p6 = "REF_DELTA" ascii
    condition:
        (uint32(0) == 0x46494c45 or true) and
        ($p1 or ($p3 and ($p5 or $p6))) and
        (2 of ($p2, $p3, $p4, $p5, $p6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109350 Gitoxide gix-pack Thin-Pack OFS_DELTA DoS Attempt"; flow:established,to_client; content:"application/x-git-upload-pack-result"; http.response_body; pcre:"/PACK\x00\x00\x00\x02/"; threshold:type both, track by_src, count 1, seconds 60; sid:2026109350; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("gix", "gitoxide", "cargo") and
  (process.args like ~ "*fetch*" or process.args like ~ "*clone*") and
  not process.parent.name in ("systemd", "cron")

Splunk SPL Query

index=app_logs (source="*gitoxide*" OR source="*gix*")
(panic OR panicked OR "LookupRefDeltaObjectsIter" OR "base_distance")
(("OFS_DELTA" OR "REF_DELTA" OR "thin pack" OR "thin-pack"))
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts by source
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="gitoxide,cve-2026-109350,">
  <rule id="1093500" level="7">
    <decoded_as>json</decoded_as>
    <match>LookupRefDeltaObjectsIter</match>
    <description>CVE-2026-109350: gix-pack panic in LookupRefDeltaObjectsIter while processing thin pack deltas</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="1093501" level="7">
    <decoded_as>json</decoded_as>
    <match>base_distance|OFS_DELTA</match>
    <description>CVE-2026-109350: Potential malformed thin-pack OFS_DELTA (base_distance) trigger</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The NVD description references gix-pack 0.75.0 as the fixed version, but no vendor advisory, commit, or release artifact has been confirmed by tracked patch sources.

1. Immediate mitigations.

   • Avoid fetching from untrusted or anonymous Git remotes using Gitoxide-based clients. Restrict remotes to known-good, internally hosted endpoints.
   • Where Gitoxide is embedded in CI/CD or build tooling, isolate fetch processes so a panic does not cascade into pipeline-wide failure (subprocess isolation, resource-limited runners).
   • Prefer standard Git (git) for untrusted remote fetch operations until a verified fix is available if gix-pack is only a secondary dependency.
   • Monitor application logs for panic strings containing LookupRefDeltaObjectsIter or thin-pack delta parsing errors.

2. Patch / upgrade steps.

   • Track the upstream Gitoxide / gix-pack repository for a published release beyond 0.75.0 with a confirmed fix. The NVD description associates the fix with version 0.75.0; verify against the canonical release notes before deploying.
   • For Rust consumers, update the gix-pack dependency in Cargo.lock and rebuild once a vetted release commit or crate version is available. Do not upgrade on the basis of the CVE description alone without checking the upstream changelog for the corresponding fix entry.
   • Re-run fetches and CI jobs against the patched build to confirm the malformed thin-pack input no longer triggers the panic.

3. Long-term hardening.

   • Vendored dependency hygiene: pin gix-pack and audit its version on a cadence, since denial-of-service defects in Git object parsing affect all downstream consumers.
   • Fuzz pack parsing in-house or integrate upstream fuzzing output tracking to catch underflow/assertion classes (CWE-617, CWE-191) early.
   • Treat Git remotes as untrusted input: enforce network egress controls on build infrastructure and cache trusted objects internally to reduce the need to fetch deltas from third-party origins.
   • Implement panic-isolation wrappers around fetch libraries so a parser panic degrades gracefully rather than aborting the host process.

References

• NVD — CVE-2026-109350: https://nvd.nist.gov/vuln/detail/CVE-2026-109350
• Gitoxide project upstream repository (track gix-pack releases and changelog for the fix associated with 0.75.0)
• CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-109350 is NOT listed as of report generation): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for this CVE. EPSS has not yet been scored by FIRST.org, and no public PoC, Nuclei template, or exploit code is available.