# CVE-2026-123533: gitoxide commit-graph parser denial of service

Source: https://junglewise.ai/threats/cve-2026-123533-gix-commitgraph-before-0-42-0-as-used-in-gitoxide-before-0-61-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123533 · Severity: medium · CVSS 5.5 · Published 2026-11-08

gitoxide is a Git implementation used to read and manipulate Git repositories, including operations like finding common commit history and displaying file blame. A crafted commit-graph file—a standard repository data file—can crash these operations and any application embedding gitoxide when processing untrusted repositories, denying service to legitimate users and workflows.

Technologies: [GitoxideLabs Gitoxide](https://junglewise.ai/threats/technologies/gitoxide). Vendors: [GitoxideLabs](https://junglewise.ai/threats/vendors/gitoxidelabs).

## Quick answers

**Is CVE-2026-123533 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123533 being exploited in the wild.

**How severe is CVE-2026-123533?** Medium severity, with a CVSS score of 5.5, published 8 November 2026.

**Which products and versions are affected?** GitoxideLabs Gitoxide before 0.61.0; GitoxideLabs Gix-Commitgraph before 0.42.0.

**Is there a fix for CVE-2026-123533?** Yes: fixed in gitoxide 0.61.0; gix-commitgraph 0.42.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123533 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-123533?** Check whether you run GitoxideLabs Gitoxide or GitoxideLabs Gix-Commitgraph at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in gitoxide 0.61.0; gix-commitgraph 0.42.0

## Technical details

The gix-commitgraph parser does not validate parent graph positions against the declared commit count or check EDGE chunk length for 4-byte alignment, leading to panics in index lookups. An attacker can craft a .git/objects/info/commit-graph file with out-of-range parent positions or misaligned EDGE chunks to trigger unwrap/panic calls, aborting processes. The vulnerability affects merge-base, blame, and any embedded use of the Repository API on untrusted repository data.

## Affected products

- GitoxideLabs gitoxide before 0.61.0
- GitoxideLabs gix-commitgraph before 0.42.0

## Timeline

- 2026-10-22: disclosed: GitHub Security Advisory GHSA-989c-xj77-266r published
- 2026-11-08: advisory: CVE-2026-123533 published on NVD

## References

- [https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-989c-xj77-266r](https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-989c-xj77-266r)
- [https://www.vulncheck.com/advisories/gitoxide-before-0.42.0-denial-of-service-via-crafted-commit-graph-file](https://www.vulncheck.com/advisories/gitoxide-before-0.42.0-denial-of-service-via-crafted-commit-graph-file)

## Related threats

- [gitoxide gix-fs NTLM credential disclosure via Windows symlink UNC probe](https://junglewise.ai/threats/cve-2026-123532-gix-fs-in-gitoxide-before-0-24-1-contains-a-credential)
- [gitoxide symlink following in .gitmodules file](https://junglewise.ai/threats/cve-2026-82252-gitoxide-symlink-following-in-gitmodules-file)
- [gitoxide path traversal in submodule name resolution](https://junglewise.ai/threats/cve-2026-82251-gitoxide-path-traversal-in-submodule-name-resolution)
- [gitoxide credential helper protocol field injection via carriage return](https://junglewise.ai/threats/cve-2026-82249-gitoxide-credential-helper-protocol-field-injection-via-carriage)
- [Gitoxide symlink prefix-reuse worktree escape during checkout](https://junglewise.ai/threats/cve-2026-44471-gitoxide-symlink-prefix-reuse-worktree-escape-during-checkout)