gitoxide's gix-url crate, versions up to 0.32.0, contains a URL parsing bug that does not recognize '?' or '#' as separators for the authority component. This flaw allows an attacker to craft an HTTP redirect response where the Location header includes a form like <attacker-authority>?@<original-authority>. When gitoxide follows the redirect, it incorrectly sends the caller's HTTP Basic Authorization header to the attacker's host. The result is the leak of HTTP Basic credentials, exposing user identities and passwords. This leads to a loss of confidentiality for any user relying on HTTP Basic authentication and is classified as CWE‑522.

Vendors: GitoxideLabs Gitoxide. Affected product versions are in the gix-url crate up to 0.32.0 (fixed in 0.37.1) and in gix-transport up to 0.49.0 (fixed in 0.58.1). Any deployment using gitoxide versions older than 0.37.1 or gix-transport older than 0.58.1 is vulnerable. No other products are noted.

With a CVSS score of 8.7, this vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation at this time. The primary attack vector is an attacker-controlled HTTP redirect response; the attacker must have the ability to influence the server that sends the redirect header. Once triggered, the client will forward stored HTTP Basic credentials to the attacker’s host. The risk is confined to individuals who authenticate with HTTP Basic credentials on affected gitoxide clients, potentially allowing an attacker to impersonate them or access protected repositories.