CVE-2026-123533

Name of the Vulnerable Software and Affected Versions gix-commitgraph versions prior to 0.42.0 gitoxide versions prior to 0.61.0

Description A denial of service issue exists because the commit-graph parser fails to validate parent graph positions against the declared commit count and does not verify that the EDGE chunk length maintains 4-byte alignment. An attacker can provide a repository with a specially crafted .git/objects/info/commit-graph file to trigger panics, which causes the termination of gix merge-base, gix blame, and other applications that embed gix.

Recommendations Update gix-commitgraph to version 0.42.0 or later. Update gitoxide to version 0.61.0 or later.