5.3
Medium
CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU…
Description
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| gix-mailmap 0.35 | earliest → < 0.35.0 | 0.35.0 |