CVE-2026-109348: gitoxidelabs gix-mailmap Inefficient Algorithmic Complexity

Vulnerability summary

CVE-2026-109348 is a medium (CVSS 5.3) Inefficient Algorithmic Complexity vulnerability in gitoxidelabs gix-mailmap. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.2% of scored vulnerabilities.

Timeline

1. 12-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.

• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.