CVE-2026-109348: Inefficient Algorithmic Complexity in GitoxideLabs gix-mailmap

CVE-2026-109348 describes a denial of service vulnerability in GitoxideLabs gix-mailmap prior to version 0.35.0. The issue arises from quadratic-time parsing in the Snapshot::from_bytes function when processing .mailmap files. Specifically, attackers can create a .mailmap file with entries ordered in descending fashion, which forces repeated front inserts during parsing. This results in excessive CPU consumption, causing worker processes that rely on this parsing (e.g., log, blame, shortlog) to be blocked for extended periods.

The vulnerability allows unauthenticated attackers to cause a denial of service by exhausting CPU resources on systems using affected versions of gix-mailmap. This can disrupt normal operations of Git-related worker processes, leading to performance degradation or temporary service unavailability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's announcements for an official fix or update to version 0.35.0 or later once available. Until then, avoid processing untrusted .mailmap files or implement resource limits to mitigate CPU exhaustion.