CVE-2026-82247: gitoxide gix-url URL parsing authority termination bypass

CVE-2026-82247 · Severity: high · CVSS 7.5 · Published 2026-08-28

gitoxide is a Rust-based Git implementation used for version control operations. Its URL parsing library fails to properly identify where the network authority ends in HTTP URLs, allowing an attacker controlling redirect responses to trick gitoxide into sending a user's HTTP Basic authentication credentials (often a personal access token) to an unintended server.

Technologies: GitoxideLabs Gix-Transport. Vendors: GitoxideLabs.

Quick answers

Is CVE-2026-82247 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82247 being exploited in the wild.
How severe is CVE-2026-82247?
High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?
GitoxideLabs Gix-Transport <= 0.49.0; GitoxideLabs Gix-Url <= 0.32.0.
Is there a fix for CVE-2026-82247?
A patch was published on 2026: gix-url fixed in 0.37.1; gix-transport fixed in 0.58.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82247 attacked?
It is attacked over the network.
Am I affected by CVE-2026-82247?
Check whether you run GitoxideLabs Gix-Transport or GitoxideLabs Gix-Url at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The gix-url crate's hand-rolled URL parser does not treat '?' or '#' characters as terminators of the authority component, violating RFC 3986 §3.2. This causes URLs like "http://attacker?@legitimate.com/repo" to incorrectly parse "legitimate.com" as the host instead of "attacker". The vulnerability becomes exploitable through gix-transport's HTTP redirect handler, which compares hosts using gix-url's parser. An attacker can craft a Location header with the form "&lt;attacker-authority&gt;?@&lt;original-authority&gt;" to bypass the redirect identity guard (can_reuse_identity), causing gitoxide to send HTTP Basic Authorization headers to the attacker's server. This affects gix-url <= 0.32.0 (fixed in 0.37.1) and gix-transport <= 0.49.0 (fixed in 0.58.1). The vulnerability is reachable by default since http.followRedirects defaults to FollowRedirects::Initial.

Affected products

  • GitoxideLabs gix-url <= 0.32.0
  • GitoxideLabs gix-transport <= 0.49.0

Timeline

  • 2026-08-28: disclosed: CVE-2026-82247 published
  • 2026: patched: gix-url fixed in 0.37.1; gix-transport fixed in 0.58.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.