CVE-2026-0810
Fixed in a distro release EPSS <1%CVSS 7.1
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
Products: GitoxideLabs gitoxide, Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| crates.io | gix-date | 0.12.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | cargo | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | clippy | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-analyzer | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-debugger-common | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-doc | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-gdb | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-src | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-std-static | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-toolset | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rust-toolset-srpm-macros | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2 | rustfmt | 1.94.0-1.amzn2.0.2 |
| Amazon Linux 2023 | cargo | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | cargo-c | 0.10.19-1.amzn2023.0.1 |
| Amazon Linux 2023 | clippy | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-analyzer | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-debugger-common | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-doc | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-gdb | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-lldb | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-src | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-std-static | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-std-static-wasm32-unknown-unknown | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-std-static-wasm32-wasip1 | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-toolset | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rust-toolset-srpm-macros | 1.94.0-1.amzn2023.0.2 |
| Amazon Linux 2023 | rustfmt | 1.94.0-1.amzn2023.0.2 |
| Chainguard | cargo-audit | 0.22.1-r0 |
| Chainguard | cargo-c | 0.10.23-r1 |
| Chainguard | helix | no fix |
| Chainguard | jujutsu | 0.37.0-r0 |
| Chainguard | starship | 1.25.0-r0 |
| Chainguard | watchexec | 2.3.3-r0 |
| Debian 13 | rust-gix-date | no fix |
| Debian 14 | rust-gix-date | no fix |
| Ubuntu 24.04 LTS | rust-gix-date | no fix |
| Ubuntu 25.10 | rust-gix-date | no fix |
| Ubuntu 26.04 LTS | rust-gix-date | no fix |
| Ubuntu 26.10 | rust-gix-date | no fix |
| Wolfi | cargo-audit | 0.22.1-r0 |
| Wolfi | cargo-c | 0.10.23-r1 |
| Wolfi | helix | no fix |
| Wolfi | starship | 1.25.0-r0 |