CVE-2026-109348 in gix-mailmap
Summary
by MITRE • 10/12/2026
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The security flaw identified within Gitoxide versions prior to 0.35.0 represents a significant denial of service vulnerability rooted in algorithmic complexity issues during the parsing of mailmap configurations. This specific weakness is categorized under CWE-400, which denotes uncontrolled resource consumption, and aligns with ATT&CK technique T1496, Resource Hijacking, as it allows an adversary to monopolize system resources through inefficient computational patterns. The vulnerability manifests specifically within the Snapshot::from_bytes function, where the implementation fails to optimize for insertion operations in data structures that require maintaining sorted order or specific positional integrity. When processing a crafted .mailmap file containing entries arranged in descending order relative to their expected sort key, the underlying algorithm is forced to perform repeated front-insertions rather than efficient appends or binary searches. This results in quadratic time complexity, O(n squared), where n represents the number of entries in the mailmap file, causing processing times to escalate dramatically as the input size increases.
The operational impact of this vulnerability is severe for users and automated systems that rely on Gitoxide-based tools such as git log, git blame, or shortlog commands. Because these operations frequently parse .mailmap files to map author identities across commits, a maliciously crafted file can cause these processes to hang indefinitely or consume excessive CPU cycles for minutes at a time. This effectively blocks worker threads and prevents the completion of legitimate version control tasks, leading to service degradation in continuous integration pipelines, code review platforms, or local development environments that process large repositories with extensive contributor histories. The attack vector is particularly insidious because .mailmap files are standard configuration artifacts often included in repository roots, meaning an attacker could potentially embed such a file within a pull request or forked repository, triggering the vulnerability when maintainers attempt to analyze commits from untrusted sources without realizing the computational cost involved.
Mitigation strategies primarily involve upgrading Gitoxide and any dependent tools like git2-rs to version 0.35.0 or later, where this quadratic parsing behavior has been addressed through algorithmic optimizations that prevent excessive front-insertions regardless of entry ordering. For environments unable to immediately upgrade, administrators should implement input validation mechanisms on .mailmap files processed by automated systems, ensuring that entries are pre-sorted before being passed to the parser or limiting the maximum file size and complexity allowed in untrusted repositories. Additionally, integrating resource monitoring tools can help detect abnormal CPU spikes associated with mailmap parsing, allowing for automatic termination of runaway processes before they impact broader system stability.