https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T22:13:18.494620+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-91986 CVE-2026-91986 — gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection 2026-09-29T22:13:18.939174+00:00

Affected: GitoxideLabs gitoxide

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.