Hi,
The following vulnerabilities were published for rust-gix-pack.
CVE-2026-109349[0]:
| gitoxide gix-pack before 0.75.0 contains a reachable assertion in
| BytesToEntriesIter::new_from_header: the pack header decoder accepts
| version 3, but a release-enabled assert_eq! requires version 2. A
| malicious remote can send a 12-byte pack header declaring version 3
| to panic the client and abort the clone or fetch.
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwg
CVE-2026-109350[1]:
| Gitoxide gix-pack before 0.75.0 contains a denial of service
| vulnerability that allows malicious remotes to crash fetch
| operations by sending crafted thin-pack OFS_DELTA entries. Attackers
| can serve a thin pack with a REF_DELTA referencing an existing
| object followed by an OFS_DELTA whose base_distance exceeds
| pack_offset, triggering a panic in LookupRefDeltaObjectsIter that
| aborts the fetch process.
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-mpf5-465h-mr53
CVE-2026-109351[2]:
| Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory
| allocation vulnerability that allows remote attackers to abort the
| process by supplying a huge pack-header object count. Malicious
| remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects,
| forcing Tree::with_capacity to reserve hundreds of gigabytes and
| crash clone or fetch operations.
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x862-c2wj-4mwr
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-109349
https://www.cve.org/CVERecord?id=CVE-2026-109349
[1] https://security-tracker.debian.org/tracker/CVE-2026-109350
https://www.cve.org/CVERecord?id=CVE-2026-109350
[2] https://security-tracker.debian.org/tracker/CVE-2026-109351
https://www.cve.org/CVERecord?id=CVE-2026-109351
Please adjust the affected versions in the BTS as needed.