Vulnerability-Lookup

OPENSUSE-SU-2026:11730-1

Vulnerability from csaf_opensuse - Published: 2026-09-09 00:00 - Updated: 2026-09-17 17:23

Summary

cargo-audit-0.22.2~git0.281452c-3.1 on GA media

Severity

Moderate

Notes

Title of the patch: cargo-audit-0.22.2~git0.281452c-3.1 on GA media

Description of the patch: These are all security issues fixed in the cargo-audit-0.22.2~git0.281452c-3.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11730

CVE-2026-82247

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-82250

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-82247

Threats

Impact moderate

CVE-2026-82251

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Recommended 4 products, the same list as for CVE-2026-82247

Threats

Impact moderate

CVE-2026-82253

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected products

Recommended 4 products, the same list as for CVE-2026-82247

Threats

Impact moderate

CVE-2026-82254

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-82247

Threats

Impact moderate

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-82247/	self
https://www.suse.com/security/cve/CVE-2026-82250/	self
https://www.suse.com/security/cve/CVE-2026-82251/	self
https://www.suse.com/security/cve/CVE-2026-82253/	self
https://www.suse.com/security/cve/CVE-2026-82254/	self
https://www.suse.com/security/cve/CVE-2026-82247	external
https://bugzilla.suse.com/1278238	external
https://www.suse.com/security/cve/CVE-2026-82250	external
https://bugzilla.suse.com/1278129	external
https://www.suse.com/security/cve/CVE-2026-82251	external
https://bugzilla.suse.com/1278228	external
https://www.suse.com/security/cve/CVE-2026-82253	external
https://bugzilla.suse.com/1278107	external
https://www.suse.com/security/cve/CVE-2026-82254	external
https://bugzilla.suse.com/1277888	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cargo-audit-0.22.2~git0.281452c-3.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the cargo-audit-0.22.2~git0.281452c-3.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11730",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11730-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-82247 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-82247/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-82250 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-82250/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-82251 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-82251/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-82253 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-82253/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-82254 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-82254/"
      }
    ],
    "title": "cargo-audit-0.22.2~git0.281452c-3.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T17:23:39Z",
      "generator": {
        "date": "2026-09-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11730-1",
      "initial_release_date": "2026-09-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:27:44Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:30:15Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:23:39Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
                "product": {
                  "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
                  "product_id": "cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cargo-audit@0.22.2~git0.281452c-3.1?arch=aarch64\u0026upstream=cargo-audit-0:0.22.2~git0.281452c-3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
                "product": {
                  "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
                  "product_id": "cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cargo-audit@0.22.2~git0.281452c-3.1?arch=ppc64le\u0026upstream=cargo-audit-0:0.22.2~git0.281452c-3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
                "product": {
                  "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
                  "product_id": "cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cargo-audit@0.22.2~git0.281452c-3.1?arch=s390x\u0026upstream=cargo-audit-0:0.22.2~git0.281452c-3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64",
                "product": {
                  "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64",
                  "product_id": "cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cargo-audit@0.22.2~git0.281452c-3.1?arch=x86_64\u0026upstream=cargo-audit-0:0.22.2~git0.281452c-3.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64"
        },
        "product_reference": "cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le"
        },
        "product_reference": "cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x"
        },
        "product_reference": "cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
        },
        "product_reference": "cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-82247",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-82247"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gitoxide\u0027s gix-url crate (\u003c= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat \u0027?\u0027 or \u0027#\u0027 as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport\u0027s HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form \u003cattacker-authority\u003e?@\u003coriginal-authority\u003e so that gitoxide sends the caller\u0027s HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions \u003c= 0.49.0 (fixed in 0.58.1).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-82247",
          "url": "https://www.suse.com/security/cve/CVE-2026-82247"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278238 for CVE-2026-82247",
          "url": "https://bugzilla.suse.com/1278238"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-82247"
    },
    {
      "cve": "CVE-2026-82250",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-82250"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-82250",
          "url": "https://www.suse.com/security/cve/CVE-2026-82250"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278129 for CVE-2026-82250",
          "url": "https://bugzilla.suse.com/1278129"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-82250"
    },
    {
      "cve": "CVE-2026-82251",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-82251"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-82251",
          "url": "https://www.suse.com/security/cve/CVE-2026-82251"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278228 for CVE-2026-82251",
          "url": "https://bugzilla.suse.com/1278228"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-82251"
    },
    {
      "cve": "CVE-2026-82253",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-82253"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gitoxide (Rust crates gix \u003c= 0.72.0 and gix-validate \u003c= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of \u0027..\u0027 via name.find(b\"..\"), allowing crafted names such as \u0027a..b/../../../.git/\u0027 to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository\u0027s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-82253",
          "url": "https://www.suse.com/security/cve/CVE-2026-82253"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278107 for CVE-2026-82253",
          "url": "https://bugzilla.suse.com/1278107"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-82253"
    },
    {
      "cve": "CVE-2026-82254",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-82254"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
          "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-82254",
          "url": "https://www.suse.com/security/cve/CVE-2026-82254"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1277888 for CVE-2026-82254",
          "url": "https://bugzilla.suse.com/1277888"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.aarch64",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.ppc64le",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.s390x",
            "openSUSE Tumbleweed:cargo-audit-0:0.22.2~git0.281452c-3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-82254"
    }
  ]
}

CVE-2026-82247 (GCVE-0-2026-82247)

Vulnerability from cvelistv5 – Published: 2026-08-28 10:49 – Updated: 2026-08-28 14:07

Title

gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing

Summary

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 14:07 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/GitoxideLabs/gitoxide/security…	vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-bef…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
GitoxideLabs	gitoxide	Affected: 0 , < 0.37.1 (semver) Unaffected: 0.37.1 (semver)
GitoxideLabs	gitoxide	Affected: 0 , < 0.58.1 (semver) Unaffected: 0.58.1 (semver)

Date Public

2026-08-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82247",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T14:07:13.308410Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T14:07:19.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-jrcm-326h-gpp8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix-url",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.37.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.37.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix-transport",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.58.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.58.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.37.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.58.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-08-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gitoxide\u0027s gix-url crate (\u003c= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat \u0027?\u0027 or \u0027#\u0027 as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport\u0027s HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form \u003cattacker-authority\u003e?@\u003coriginal-authority\u003e so that gitoxide sends the caller\u0027s HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions \u003c= 0.49.0 (fixed in 0.58.1)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T10:49:33.476Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jrcm-326h-gpp8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-jrcm-326h-gpp8"
        },
        {
          "name": "VulnCheck Advisory: gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gitoxide-before-0.37.1-http-basic-credential-leak-via-url-parsing"
        }
      ],
      "title": "gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82247",
    "datePublished": "2026-08-28T10:49:33.476Z",
    "dateReserved": "2026-08-28T10:37:51.949Z",
    "dateUpdated": "2026-08-28T14:07:19.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82250 (GCVE-0-2026-82250)

Vulnerability from cvelistv5 – Published: 2026-08-28 10:49 – Updated: 2026-08-28 15:52

Title

gitoxide gix-packetline before 0.21.5 Denial of Service

Summary

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 14:42 UTC

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/GitoxideLabs/gitoxide/security…	vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-gix…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
GitoxideLabs	gitoxide	Affected: 0 , < 0.21.5 (semver) Unaffected: 0.21.5 (semver) cpe:2.3:a:gitoxidelabs:gitoxide::::::::

Date Public

2026-06-16 00:00

Credits

KutalVolkan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T14:42:05.655501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:52:43.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix-packetline",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.21.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.21.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.21.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "KutalVolkan"
        }
      ],
      "datePublic": "2026-06-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T10:49:35.517Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2vh6-hw4j-32ww)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww"
        },
        {
          "name": "VulnCheck Advisory: gitoxide gix-packetline before 0.21.5 Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gitoxide-gix-packetline-before-0.21.5-denial-of-service"
        }
      ],
      "title": "gitoxide gix-packetline before 0.21.5 Denial of Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82250",
    "datePublished": "2026-08-28T10:49:35.517Z",
    "dateReserved": "2026-08-28T10:37:51.949Z",
    "dateUpdated": "2026-08-28T15:52:43.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82251 (GCVE-0-2026-82251)

Vulnerability from cvelistv5 – Published: 2026-08-28 10:49 – Updated: 2026-08-29 13:38

Title

gitoxide before 0.52.1 Path Traversal via Submodule Name

Summary

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 14:42 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/GitoxideLabs/gitoxide/security…	vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-bef…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
GitoxideLabs	gitoxide	Affected: 0 , < 0.52.1 (semver) Unaffected: 0.52.1 (semver)
GitoxideLabs	gitoxide	Affected: 0 , < 0.82.0 (semver) Unaffected: 0.82.0 (semver)

Date Public

2026-04-25 00:00

Credits

N0zoM1z0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82251",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T14:42:08.492343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T14:42:37.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gitoxide",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.52.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.52.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.82.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.82.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.52.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.82.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "N0zoM1z0"
        }
      ],
      "datePublic": "2026-04-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and open() functions to repositories outside .git/modules, causing repository confusion and inspection of attacker-controlled repositories."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T13:38:27.250Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fr8x-3vfx-f45h)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-fr8x-3vfx-f45h"
        },
        {
          "name": "VulnCheck Advisory: gitoxide before 0.52.1 Path Traversal via Submodule Name",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gitoxide-before-0.52.1-path-traversal-via-submodule-name"
        }
      ],
      "title": "gitoxide before 0.52.1 Path Traversal via Submodule Name",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82251",
    "datePublished": "2026-08-28T10:49:36.185Z",
    "dateReserved": "2026-08-28T10:37:51.949Z",
    "dateUpdated": "2026-08-29T13:38:27.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82253 (GCVE-0-2026-82253)

Vulnerability from cvelistv5 – Published: 2026-08-28 10:49 – Updated: 2026-08-31 18:34

Title

gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

Summary

gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 18:33 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/GitoxideLabs/gitoxide/security…	vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-bef…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
GitoxideLabs	gitoxide	Affected: 0 , < 0.82.0 (semver) Unaffected: 0.82.0 (semver)
GitoxideLabs	gitoxide	Affected: 0 , < 0.11.1 (semver) Unaffected: 0.11.1 (semver)

Date Public

2026-04-25 00:00

Credits

kodareef5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82253",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T18:33:43.567345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T18:34:55.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-p3hw-mv63-rf9w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.82.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.82.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix-validate",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.11.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.11.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.82.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.11.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "kodareef5"
        }
      ],
      "datePublic": "2026-04-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gitoxide (Rust crates gix \u003c= 0.72.0 and gix-validate \u003c= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of \u0027..\u0027 via name.find(b\"..\"), allowing crafted names such as \u0027a..b/../../../.git/\u0027 to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository\u0027s git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T10:49:37.566Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-p3hw-mv63-rf9w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-p3hw-mv63-rf9w"
        },
        {
          "name": "VulnCheck Advisory: gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gitoxide-before-0.82.0-path-traversal-via-submodule-name-validation-bypass"
        }
      ],
      "title": "gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82253",
    "datePublished": "2026-08-28T10:49:37.566Z",
    "dateReserved": "2026-08-28T10:39:30.355Z",
    "dateUpdated": "2026-08-31T18:34:55.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82254 (GCVE-0-2026-82254)

Vulnerability from cvelistv5 – Published: 2026-08-28 10:49 – Updated: 2026-08-28 13:59

Title

gitoxide before 0.69.0 Denial of Service via gix-pack

Summary

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 13:58 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/GitoxideLabs/gitoxide/security…	vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-bef…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
GitoxideLabs	gitoxide	Affected: 0 , < 0.69.0 (semver) Unaffected: 0.69.0 (semver) cpe:2.3:a:gitoxidelabs:gitoxide::::::::

Date Public

2026-04-25 00:00

Credits

kodareef5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82254",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T13:58:52.170489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T13:59:07.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/gix-pack",
          "product": "gitoxide",
          "vendor": "GitoxideLabs",
          "versions": [
            {
              "lessThan": "0.69.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.69.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gitoxidelabs:gitoxide:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.69.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "kodareef5"
        }
      ],
      "datePublic": "2026-04-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T10:49:38.250Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-x494-mj8g-cj27)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x494-mj8g-cj27"
        },
        {
          "name": "VulnCheck Advisory: gitoxide before 0.69.0 Denial of Service via gix-pack",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gitoxide-before-0.69.0-denial-of-service-via-gix-pack"
        }
      ],
      "title": "gitoxide before 0.69.0 Denial of Service via gix-pack",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82254",
    "datePublished": "2026-08-28T10:49:38.250Z",
    "dateReserved": "2026-08-28T10:39:30.355Z",
    "dateUpdated": "2026-08-28T13:59:07.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11730-1

CVE-2026-82247 (GCVE-0-2026-82247)

CVE-2026-82250 (GCVE-0-2026-82250)

CVE-2026-82251 (GCVE-0-2026-82251)

CVE-2026-82253 (GCVE-0-2026-82253)

CVE-2026-82254 (GCVE-0-2026-82254)

Tags

Sightings

Nomenclature

Related by attack behaviour