CVE-2026-82247: Insufficiently Protected Credentials in GitoxideLabs gitoxide

The vulnerability CVE-2026-82247 affects GitoxideLabs gitoxide's gix-url and gix-transport crates. Specifically, the gix-url crate's URL parser in versions up to 0.32.0 incorrectly processes the '?' and '#' characters, leading to improper host comparison by the HTTP redirect identity guard in gix-transport versions up to 0.49.0. This improper comparison can be exploited by an attacker controlling a redirect response to craft a malicious Location header, causing gitoxide to inadvertently send HTTP Basic Authorization credentials to an attacker-controlled host.

An attacker who can control an HTTP redirect response can exploit this vulnerability to cause gitoxide to send HTTP Basic Authorization credentials to an unintended host. This could lead to credential exposure and potential unauthorized access to sensitive resources. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor GitoxideLabs' official advisories for updates and apply any official fixes once available. Until a fix is released, avoid using affected versions or mitigate exposure to untrusted HTTP redirects if possible.