Threats tagged 'ghsa-5h7f-ghvg-967h'

A denial of service vulnerability exists in gix-commitgraph before version 0.42.0, as used in gitoxide before 0.61.0. The issue arises because the commit-graph parser does not properly validate parent graph positions against the declared commit count and fails to check the EDGE chunk length for 4-byte alignment. This can cause panics that abort operations such as gix merge-base, gix blame, and other applications embedding gix when processing a crafted .git/objects/info/commit-graph file.