Gitoxide gix-mailmap versions prior to 0.35.0 implement a quadratic-time parser for the .mailmap file, which can be triggered by a crafted file with many descending-ordered entries. Parsing such a file forces repeated front inserts in the Snapshot::from_bytes routine, exhausting CPU resources and preventing commands that read the mailmap—such as log, blame, or shortlog—from returning for minutes. The weakness is a classic instance of O(N^2) processing time, categorized as CWE‑407.

The vulnerability affects GitoxideLabs’ gix-mailmap component in all releases before 0.35.0. Any deployment that uses these versions and processes user‑supplied or repository‑supplied .mailmap files is potentially exposed.

The CVSS base score of 5.3 indicates a moderate severity. No EPSS score is reported, suggesting limited publicly known exploitation data. KEV does not list this issue, meaning it is not part of the high‑profile exploit catalog. The failure to parse a malicious .mailmap only occurs when an attacker can introduce or modify the file in a repository; thus the attack vector is typically local or requires write access to the repository. Once the buggy file is present, any user running git commands that read the mailmap will suffer CPU exhaustion.