Is CVE-2026-109351 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109351?

CVE-2026-109351 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109351

Description

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.