Shuvamk

**Name of the Vulnerable Software and Affected Versions** gix-url versions prior to 0.37.1 gix-transport versions prior to 0.58.1 **Description** The `gix-url` crate employs a custom URL parser that fails to treat '?' or '#' as terminators for the authority component, violating RFC 3986. This leads to a failure in the `can reuse identity()` function within `gix-transport`, which incorrectly compares hosts during HTTP redirect identity guards. An attacker who controls a redirect response can manipulate the `Location` header using the format `<attacker-authority>?@<original-authority>`, causing the system to send HTTP Basic Authorization credentials to an unauthorized host. **Recommendations** Update gix-url to version 0.37.1 or later. Update gix-transport to version 0.58.1 or later.