7.1 High

CVE-2026-0810 Gix-date: gix-date: undefined behavior due to invalid string generation

Description

A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitable with local access to the machine, with an ordinary account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
gitoxide 0.12	earliest → < 0.12.0	0.12.0
Logging Subsystem for Red Hat OpenShift	Versions not published
Red Hat Enterprise Linux 10	Versions not published
Red Hat Enterprise Linux 8	Versions not published
Red Hat Enterprise Linux 9	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2427057 bugzilla.redhat.com
crates.io crates.io
github.com github.com
rustsec.org rustsec.org

Timeline

Published January 26, 2026
Last modified November 5, 2026

The 16 CVEs of gitoxide →

CVE-2026-100419 gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that… 7.3 High CVE-2026-91986 gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing… 5.3 Medium CVE-2025-24890 gitoxide is an implementation of git written in Rust 6.8 Medium CVE-2026-82255 gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where… 7.6 High

Track this CVE