gix-commitgraph before 0.42.0, which is used by gitoxide before 0.61.0, contains a denial-of-service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count and does not check the EDGE chunk length for 4-byte alignment; supplying a repository with a crafted .git/objects/info/commit-graph file causes panics that abort gix merge-base, gix blame, and any application embedding gix, resulting in a denial of service for the process that parses the file.

The affected products are GitoxideLabs’ gitoxide before version 0.61.0, which includes the gix-commitgraph library before 0.42.0, and any application that embeds the gix library. No other vendors are explicitly identified.

The CVSS score is 6.8, indicating moderate severity. EPSS is not available, so the likelihood of exploitation is unclear but may be considered low-to-moderate. The vulnerability is not listed in CISA’s KEV catalog. Attackers can supply a malicious commit-graph file in a repository that is cloned or otherwise processed by gitoxide or applications using gix, which can be a local or remote vector if the repository is exposed. Because the bug requires only a crafted file, the exploitation is straightforward once the attacker can deliver the file, giving the attacker a predictable denial-of-service outcome.