CVE-2026-109348
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers running log, blame, or shortlog for minutes.