CVE-2026-91986

Name of the Vulnerable Software and Affected Versions gitoxide gix-transport versions prior to 0.59.2

Description The software fails to filter control characters in git-daemon connect requests. This allows attackers to inject NUL, CR, or LF bytes through specially crafted git URLs. Such injection can be used to add extra NUL-delimited protocol fields to spoof virtual hosts or insert newlines into daemon requests and logs.

Recommendations Update gitoxide gix-transport to version 0.59.2 or later.