Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109350Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Medium 6.5

In plain English

A medium-severity security flaw in gix-pack from GitoxideLabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	rust-gix-pack	no fix listed	DEBIAN-CVE-2026-109350
Debian:14	rust-gix-pack	no fix listed	DEBIAN-CVE-2026-109350
Ubuntu:26.04:LTS	rust-gix	no fix listed	UBUNTU-CVE-2026-109350
Ubuntu:26.10	rust-gix	no fix listed	UBUNTU-CVE-2026-109350

Affected products (as reported)

Vendor	Product	Versions
GitoxideLabs	gix-pack	0 – before 0.75.0

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-mpf5-465h-mr53) vendor-advisory
VulnCheck Advisory: Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance third-party-advisory