Most recent entries from all

Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:03:26 +0000 fkie_cve-2026-82247 https://vulnerability.circl.lu/vuln/fkie_cve-2026-82247 <p>gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).</p> <p>gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-82247 GHSA-c828-8g79-fpj5 https://vulnerability.circl.lu/vuln/ghsa-c828-8g79-fpj5 <p>gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).</p> <p>gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).</p> https://vulnerability.circl.lu/vuln/ghsa-c828-8g79-fpj5 openSUSE-SU-2026:11730-1 — cargo-audit-0.22.2~git0.281452c-3.1 on GA media https://vulnerability.circl.lu/vuln/opensuse-su-2026:11730-1 <p>cargo-audit-0.22.2~git0.281452c-3.1 on GA media</p> <p>cargo-audit-0.22.2~git0.281452c-3.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11730-1 UBUNTU-CVE-2026-82247 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82247 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-gix-transport, Ubuntu:24.04:LTS: rust-gix-url, Ubuntu:26.04:LTS: rust-gix-transport, Ubuntu:26.04:LTS: rust-gix-url</p> <p>gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: rust-gix-transport, Ubuntu:24.04:LTS: rust-gix-url, Ubuntu:26.04:LTS: rust-gix-transport, Ubuntu:26.04:LTS: rust-gix-url</p> <p>gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82247