medium4.3
CVE-2026-109348
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::…
Impact
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.
Affected products
| Product | Affected versions |
|---|---|
| Gitoxide Gix-Mailmap | before 0.35.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.