Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
gitoxide can be tricked into connecting to a fake host
published 1 month ago
Summary
The gitoxide tool on openSUSE may accept specially crafted URLs that insert hidden characters, causing it to connect to a server you did not intend. This could let an attacker make the program talk to a malicious host and potentially intercept data. Update gitoxide to the latest version to stop this behavior.
What to do
- Update opensuse gitoxide to version 0.56.0-bp160.2.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openSUSE:Leap 16.0 | opensuse | gitoxide |
< 0.56.0-bp160.2.1 Fix: upgrade to 0.56.0-bp160.2.1
|
Original advisory text
Security update for gitoxide
This update for gitoxide fixes the following issues:
Changes in gitoxide:
- CVE-2026-91986: gix-transport CR/LF/NUL injection into
git-daemon connect request via crafted git URL path,
allowing virtual-host spoofing (boo#1281749)
Changes in gitoxide:
- CVE-2026-91986: gix-transport CR/LF/NUL injection into
git-daemon connect request via crafted git URL path,
allowing virtual-host spoofing (boo#1281749)
References
- https://bugzilla.suse.com/1281749 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-91986 URL
Timeline
Published24 Sep 2026
Updated25 Sep 2026
First seen25 Sep 2026
Sources
openSUSE-SU-2026:21955-1 · OSV
Track software like this
Free during beta