VDB
RHSA-2026:83849
RHSA-2026:83849
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in gix-pack. A malicious remote server can trigger a Denial of Service (DoS) by returning a crafted pack header declaring version 3 during a repository clone or fetch operation. Because the header decoder triggers an internal assertion failure when encountering this version, the client application crashes immediately, terminating the operation.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rust-doc-0:1.99.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-i686-pc-windows-gnu-0:1.99.0-1.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-x86_64-unknown-none-0:1.99.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-i686-pc-windows-gnu-0:1.99.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-aarch64-unknown-none-softfloat-0:1.99.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-debugger-common-0:1.99.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-wasm32-wasip1-0:1.99.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | clippy-0:1.99.0-1.1.hum1@s390x as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-doc-0:1.99.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-analyzer-0:1.99.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-aarch64-unknown-none-softfloat-0:1.99.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-std-static-wasm32-wasip1-0:1.99.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-lldb-0:1.99.0-1.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-0:1.99.0-1.1.hum1@src as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rustfmt-0:1.99.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-src-0:1.99.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-src-0:1.99.0-1.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-doc-0:1.99.0-1.1.hum1@s390x as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-src-0:1.99.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
| Red Hat | rust-0:1.99.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images | 1.99.0-1.1.hum1 |
…and 38 more
Timeline
- Oct 16, 2026 CVE Published
- Oct 17, 2026 CVE Updated
- Oct 17, 2026 Distribution Patch
- Oct 17, 2026 Distribution Patch
- Oct 17, 2026 Security Advisory
- Oct 17, 2026 Security Advisory
- Oct 17, 2026 Security Advisory
- Oct 17, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:83849 advisory
- https://access.redhat.com/security/cve/CVE-2026-109349 advisory
- https://access.redhat.com/security/cve/CVE-2026-109350 advisory
- https://access.redhat.com/security/cve/CVE-2026-109351 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83849.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2549829 issue
- https://www.cve.org/CVERecord?id=CVE-2026-109349 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109349 advisory
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwg advisory
- https://www.vulncheck.com/advisories/gix-pack-before-0.75.0-reachable-assertion-dos-via-pack-version-3-header advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2549792 issue
- https://www.cve.org/CVERecord?id=CVE-2026-109350 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109350 advisory
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-mpf5-465h-mr53 advisory
- https://www.vulncheck.com/advisories/gitoxide-gix-pack-before-0.75.0-denial-of-service-via-ofs-delta-base-distance advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2549767 issue
- https://www.cve.org/CVERecord?id=CVE-2026-109351 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109351 advisory
…and 2 more