CVE-2026-0810: gitoxidelabs gitoxide
Vulnerability summary
CVE-2026-0810 is a high (CVSS 7.1) vulnerability in gitoxidelabs gitoxide. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 26-01-2026PublishedVulnerability first disclosed.
- 20-04-2026Last modifiedVulnerability information updated.
Description
A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.
CVSS metrics
7 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.01 pp
From 0.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGitoxide
Maturity: poc
Weaknesses
CWE · root cause- CWE-135Incorrect Calculation of Multi-Byte String LengthThe product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
- CWE-682Incorrect CalculationThe product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Affected systems
Chainguard6 products
- cargo-audit< 0.22.1-r0
- cargo-c< 0.10.23-r1
- helixAll versions (No fix recorded)
- jujutsu< 0.37.0-r0
- starship< 1.25.0-r0
Wolfi4 products
- cargo-audit< 0.22.1-r0
- cargo-c< 0.10.23-r1
- helixAll versions (No fix recorded)
- starship< 1.25.0-r0
Crates.Io1 product
- gix-date< 0.12.0 | ≥ 0.0.0-0, < 0.12.0
Debian1 product
- rust-gix-dateAll versions (No fix recorded)
Ubuntu1 product
- rust-gix-dateAll versions (No fix recorded)
6 vendors · 15 products
References
14 links- access.redhat.com/security/cve/CVE-2026-0810VDB EntryX Refsource REDHATAdvisoryWEBThird Party Advisory
