AZL-108564
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108564.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-108564
- Upstream
- Published
- 2026-10-12T17:17:32Z
- Modified
- 2026-11-02T05:31:37Z
- Summary
- CVE-2026-109351 affecting package rust 1.98.1-1
- Details
-
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
- References