Description

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:36.500Z",
  "pubdate": "2026-08-28T12:16:36.500Z",
  "executiveSummary": "A critical vulnerability exists in the gitoxide ecosystem due to non-compliant URL parsing logic within the gix-url crate. By failing to correctly identify '?' and '#' characters as authority component terminators according to RFC 3986, the parser incorrectly handles malformed URLs.\nThis flaw resides in the gix-transport crate's can_reuse_identity function, which relies on gix-url for host verification during HTTP redirects. An attacker capable of influencing HTTP redirect responses can exploit this identity guard failure to perform credential exfiltration.\nThe vulnerability allows an attacker to manipulate the Location header such that the client mistakenly identifies the attacker's server as the original, trusted host. Consequently, gitoxide transmits HTTP Basic Authorization credentials—intended for the legitimate host—to the attacker-controlled endpoint.\nThis impacts gix-url versions <= 0.32.0 and gix-transport versions <= 0.49.0. The vulnerability presents a severe risk to confidentiality, as sensitive authentication tokens and credentials can be intercepted. Exploitation requires the attacker to successfully trigger a redirect, typically occurring when a client interacts with a compromised or malicious repository server.",
  "technicalDetails": "The root cause of this vulnerability is an RFC 3986 non-compliant hand-rolled URL parser in the gix-url crate. In standard URI specifications, the authority component is terminated by the presence of characters such as '?', '#', '/', or the end of the string. The gix-url parser fails to recognize '?' and '#' as valid terminators, which leads to an incorrect decomposition of the URL structure.\nThis parsing failure directly undermines the security logic within gix-transport, specifically the can_reuse_identity function. This function is designed to prevent the leaking of authentication credentials across different host identities during HTTP redirects. Because the parser incorrectly breaks down the URL string, the identity guard compares the attacker-supplied host against the original host erroneously, resulting in a 'fail-open' condition.\nExploitation involves the following flow: 1) A client initiates a request to a legitimate repository. 2) The repository returns an HTTP redirect (3xx) containing a crafted Location header. 3) The header is formatted as <attacker-authority>?@<original-authority>. 4) The gix-url parser, failing to stop the authority parse at the '?', includes the remaining part of the string in the host component analysis. 5) The can_reuse_identity function misinterprets the resulting data, erroneously concluding that the destination is the same as the original host. 6) The client proceeds to send the HTTP Basic Authorization header to the attacker-controlled <attacker-authority> host.\nThis attack vector allows for the silent exfiltration of Basic Authentication credentials, which are transmitted in plaintext (base64 encoded) over the wire if not protected by secondary layers or if the attacker manages to intercept the connection. The impact is significant as it facilitates unauthorized access to the victim's authentication material, enabling further unauthorized repository access or impersonation. The vulnerability affects gix-url versions up to 0.32.0 and gix-transport up to 0.49.0, requiring immediate updates to versions 0.37.1 and 0.58.1, respectively, which introduce robust parsing logic compliant with established URI standards."
}