CVE-2026-109348 — Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attack…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7