CVE-2026-91986
Fixed in a distro release EPSS <1%CVSS 5.4
gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and logs.
Products: GitoxideLabs gitoxide
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | rust-gix-transport | no fix |
| Debian 14 | rust-gix-transport | no fix |
| Ubuntu 24.04 LTS | rust-gix-transport | no fix |
| Ubuntu 26.04 LTS | rust-gix-transport | no fix |
| Ubuntu 26.10 | rust-gix-transport | no fix |
| openSUSE Leap 16.0 | gitoxide | 0.56.0-bp160.2.1 |
| openSUSE Leap 16.0 | gitoxide | 0.60.0-bp160.1.1 |
| openSUSE Tumbleweed | gitoxide | 0.58.0-2.1 |
| openSUSE Tumbleweed | openai-codex | 0.158.0-1.1 |
| openSUSE Tumbleweed | stgit | 2.7.0-1.1 |