CVE-2026-109351

Executive Summary

CVE-2026-109351 is an uncontrolled memory allocation vulnerability (CWE-770) in Gitoxide's gix-pack component prior to version 0.75.0. A malicious Git remote can send a 12-byte pack header that declares 0xFFFFFFFF objects, causing Tree::with_capacity to pre-allocate hundreds of gigabytes and aborting the client process during clone or fetch operations. This results in a denial-of-service condition for developers and CI/CD pipelines using affected Gitoxide-based tooling, with a CVSS v3.1 base score of 6.5 (network-accessible, low complexity, no privileges, user interaction required, availability-only impact).

Technical Analysis

The vulnerability resides in the pack-file parsing subsystem of Gitoxide, specifically within the gix-pack crate. Git's packfile format begins with a fixed 12-byte header: a 4-byte signature ("PACK"), a 4-byte version, and a 4-byte big-endian object count. When a client clones or fetches from a remote, it reads this header to determine how many objects to expect and, in the vulnerable code path, uses that count to size in-memory data structures.

The flaw class is CWE-770 (Allocation of Resources Without Limits or Throttling). Gitoxide does not validate the declared object count against any sanity bound, remaining pack bytes, or negotiated transfer size before calling Tree::with_capacity with that value. Because the field is a 32-bit unsigned integer, an attacker can declare 0xFFFFFFFF (4,294,967,295) objects in a single 12-byte header. The allocator then attempts to reserve backing storage proportional to that count — described in the NVD entry as "hundreds of gigabytes" — which either fails outright or triggers an abort, terminating the process. This is an availability-only impact: no integrity, confidentiality, or code-execution primitive is described.

Key technical properties:

• Attack surface: The pack-header parser in gix-pack, reached via clone and fetch operations against a remote repository.
• Precondition: The victim must initiate a clone or fetch against an attacker-controlled (or attacker-compromised) Git remote — hence the UI:R user-interaction vector.
• Trigger artifact: A 12-byte pack header. No large payload is required; the amplification is inherent to the unvalidated capacity reservation.
• Failure mode: Process abort from allocation failure, not memory corruption.

The fix boundary in the NVD description is gix-pack 0.75.0, implying the corrected release imposes an upper bound or validates the declared count against the header/data size. No patch artifact has been confirmed by any tracked source (patch confidence 0/4), so the exact validation logic cannot be verified and is not asserted here.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred at the vulnerability-class level from the NVD description; no specific function names, endpoints, or parameters beyond those in the description are invented.

1. Reconnaissance / target identification. An attacker identifies a victim workflow that clones or fetches from a Git remote. Viable vectors include a public repository the attacker controls, a typosquatted repository name, a compromised upstream dependency host, a malicious mirror, or a repository referenced by a pull-request/CI trigger. Targets of interest are automated agents (CI/CD runners, build bots) and developer workstations using Gitoxide-based clients or libraries.

2. Triggering the flaw class. Because the dangerous input is a 12-byte header, the attacker only needs to make the victim's client read it. The attacker configures a remote whose pack stream begins with a header declaring 0xFFFFFFFF objects. This can be delivered as part of a normal negotiation: the client connects, negotiates refs, and requests a pack, and the malicious header is the first content the parser consumes. No malformed credentials or special privileges are needed.

3. Payload / execution method (class level). Delivery is the vulnerable parser consuming the oversized object count on the Tree::with_capacity code path. The "payload" is effectively the integer itself — the allocation request derived from it — rather than an exploit shellcode. The attacker's work is reduced to serving a minimal, well-formed-enough header.

4. Post-exploitation impact. The client aborts, so the clone/fetch never completes. Consequences are availability-driven: broken builds, interrupted pipelines, wasted compute, and potential cascading failures in automation that depends on the fetch succeeding. There is no described persistence, data exfiltration, or lateral movement. Repeated attacker-controlled remotes can produce sustained denial of service.

Impact Assessment

Per the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, the base score is 6.5 (Medium):

• AV:N (Network): the malicious pack header is delivered over a network Git operation.
• AC:L (Low): no race, no special conditions — a single crafted header suffices.
• PR:N (None): no authentication or authorization is required.
• UI:R (Required): the victim must initiate the clone/fetch against the malicious remote.
• S:U (Unchanged): the impact is confined to the vulnerable client process.
• C:N / I:N: no confidentiality or integrity impact is described.
• A:H (High): the process aborts, causing total loss of availability for that operation.

Business impact: Denial of service against developer and build environments. Affected systems include any tooling that embeds Gitoxide or the gix-pack crate: Gitoxide CLI utilities, Rust applications using gix for repository operations, editor/IDE integrations, and CI/CD runners that perform clones/fetches. Blast radius is bounded by the number of users and pipelines pulling from the malicious or compromised remote. Because no memory corruption is described, there is no direct blast radius beyond the process and the pipeline step that depends on it.

Detection Guidance

Sigma Rule

title: Gitoxide gix-pack Oversized Pack Header Denial of Service
id: 3f1c9a72-6b4d-4e8a-9c21-0a7b5e10d9f4
status: experimental
description: Detects process aborts / out-of-memory terminations of Gitoxide-based clients during clone or fetch, potentially caused by a malicious remote serving a pack header with an excessive object count (CVE-2026-109351).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109351
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/gix'
      - '/gitoxide'
  selection_fail:
    CommandLine|contains:
      - 'clone'
      - 'fetch'
  selection_abort:
    - ExitCode: '134'
    - Message|contains:
        - 'memory allocation'
        - 'OutOfMemory'
        - 'capacity overflow'
  condition: selection_proc and selection_fail and selection_abort
fields:
  - Image
  - CommandLine
  - ExitCode
falsepositives:
  - Legitimate large repositories exhausting memory on constrained hosts
level: medium

YARA Rule

rule CVE_2026_109351_GixPack_Oversized_Pack_Header
{
    meta:
        description = "Detects Git pack headers declaring an unrealistic object count consistent with CVE-2026-109351"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109351"
        date = "2026-01-01"
        severity = "medium"

    strings:
        // Git pack signature "PACK" followed by version 2/3
        $pack = { 50 41 43 4B 00 00 00 02 }
        $pack3 = { 50 41 43 4B 00 00 00 03 }
        // Object count 0xFFFFFFFF immediately after 8-byte header
        $maxcount = { FF FF FF FF }
        // Hostile high counts commonly preceding the max value region
        $highcount = { F0 ?? ?? ?? }

    condition:
        filesize >= 12 and filesize < 4096 and
        (($pack at 0 or $pack3 at 0) and $maxcount at 8)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-109351 Gitoxide gix-pack oversized object count in pack header"; flow:established,to_client; content:"PACK"; depth:4; content:"|FF FF FF FF|"; distance:4; within:4; classtype:attempted-dos; reference:cve,2026-109351; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109351; sid:2026109351; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("gix", "gitoxide") and
  process.command_line : ("*clone*" or "*fetch*") and
  (process.exit_code == 134 or process.exit_code == 137)

Splunk SPL Query

index=endpoint (process_name="gix" OR process_name="gitoxide")
| search (process_command_line="*clone*" OR process_command_line="*fetch*")
| where exit_code IN (134, 137) OR match(_raw, "(?i)(memory allocation|OutOfMemory|capacity overflow)")
| stats count values(process_command_line) as commands by host, user
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="gitoxide,cve-2026-109351,">
  <rule id="109351" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">gix|gitoxide</field>
    <field name="process.command_line">clone|fetch</field>
    <description>CVE-2026-109351: Gitoxide clone/fetch aborted, possible malicious pack header (oversized object count)</description>
    <options>no_full_log</options>
  </rule>

  <rule id="109352" level="12">
    <if_sid>109351</if_sid>
    <field name="process.exit_code">134|137</field>
    <description>CVE-2026-109351: Gitoxide process terminated by allocation failure during clone/fetch</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED, with no patch evidence from any tracked source. The NVD description references a fixed boundary (gix-pack 0.75.0), but no vendor advisory or commit has been confirmed through tracked sources. Treat the version boundary as unverified until an authoritative advisory is published.

1) Immediate mitigations (no patch required):

• Restrict which remotes can be cloned or fetched in automated pipelines; use an allowlist of trusted upstream hosts rather than arbitrary user-supplied URLs.
• Apply resource limits to Git client processes — cgroup memory caps, ulimit -v/-m, and container memory limits — so an oversized capacity request fails fast instead of exhausting the host.
• Prefer shallow or partial fetches where operationally feasible to reduce exposure to full pack negotiation against untrusted remotes.
• Isolate CI runners so that an aborted clone cannot cascade into other jobs; treat fetch failure as a soft failure with bounded retries.
• Monitor for repeated clone/fetch aborts against the same remote and block offenders at the network egress boundary.

2) Patch/upgrade steps:

• Because patch confidence is 0/4, confirm any fix directly from the upstream Gitoxide project before relying on it. Verify that the gix-pack release in use enforces a bound on the declared object count relative to the actual pack size.
• Track the Gitoxide repository releases and the RustSec advisory database for an authoritative fix once published.
• Until a verified fix exists, avoid running vulnerable gix-pack versions against untrusted remotes.

3) Long-term hardening:

• Adopt a policy of validating length/count fields from untrusted network input against remaining data length before allocating.
• Add memory ceilings and allocation-failure telemetry to all build and developer tooling.
• Include dependency-review controls for Git client libraries so newly disclosed DoS issues are triaged promptly.
• Encourage upstream libraries to implement configurable object-count caps and graceful, recoverable errors instead of aborting.

References

1. NVD — CVE-2026-109351: https://nvd.nist.gov/vuln/detail/CVE-2026-109351
2. CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. First.org EPSS — score not yet assigned for CVE-2026-109351: https://api.first.org/data/v1/epss?cve=CVE-2026-109351
5. Gitoxide project repository (track upstream advisories and releases): https://github.com/GitoxideLabs/gitoxide

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild exploitation evidence is currently known for CVE-2026-109351. CISA KEV status: NO. No threat actor campaign has been attributed to this vulnerability at the time of writing.