CVE catalog
CVE-2026-82247
cargo-audit-0.22.2~git0.281452c-3.1 on GA media
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.41% · Oct 23, 2026
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rust-gix-transport | 13 | 0.44.0-1 | vulnerable |
| Debian | rust-gix-transport | 13 | 0.48.0-1 | vulnerable |
| Debian | rust-gix-transport | 13 | 0.48.0-2 | vulnerable |
| Debian | rust-gix-transport | 13 | 0.57.0-1 | vulnerable |
| Debian | rust-gix-transport | 13 | 0.58.1-1 | vulnerable |
| Debian | rust-gix-transport | 13 | 0.59.2-1 | vulnerable |
| Debian | rust-gix-transport | 14 | 0.44.0-1 | vulnerable |
| Debian | rust-gix-transport | 14 | 0.48.0-1 | vulnerable |
| Debian | rust-gix-transport | 14 | 0.48.0-2 | vulnerable |
| Debian | rust-gix-transport | 14 | 0.57.0-1 | vulnerable |
| Debian | rust-gix-transport | 14 | 0.58.1-1 | fixed |
| Debian | rust-gix-url | 13 | 0.28.2-1 | vulnerable |
| Debian | rust-gix-url | 13 | 0.32.0-1 | vulnerable |
| Debian | rust-gix-url | 13 | 0.36.0-1 | vulnerable |
| Debian | rust-gix-url | 13 | 0.37.1-1 | vulnerable |
| Debian | rust-gix-url | 13 | 0.38.0-1 | vulnerable |
| Debian | rust-gix-url | 14 | 0.28.2-1 | vulnerable |
| Debian | rust-gix-url | 14 | 0.32.0-1 | vulnerable |
| Debian | rust-gix-url | 14 | 0.36.0-1 | vulnerable |
| Debian | rust-gix-url | 14 | 0.37.1-1 | fixed |
| Opensuse | cargo-c | tumbleweed | 0.10.25-1.1 | fixed |
| Opensuse | cargo-audit | tumbleweed | 0.22.2~git0.281452c-3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rust-gix-transport | deb | 14 | 0.58.1-1 | Not reported | DEBIAN-CVE-2026-82247 | Not reported |
| Debian | rust-gix-url | deb | 14 | 0.37.1-1 | Not reported | DEBIAN-CVE-2026-82247 | Not reported |
| Opensuse | cargo-c | rpm | tumbleweed | 0.10.25-1.1 | Not reported | OPENSUSE-SU-2026:11741-1 | Not reported |
| Opensuse | cargo-audit | rpm | tumbleweed | 0.22.2~git0.281452c-3.1 | Not reported | OPENSUSE-SU-2026:11730-1 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [librust-gix-transport-dev]Affected
Source package: [rust-gix-transport]
Details (2)
0.44.0-1· amd64 · trixieAffected
pypi · rust-gix-transport · debian · 13
0.44.0-1· arm64 · trixieAffected
pypi · rust-gix-transport · debian · 13
- [librust-gix-url-dev]Affected
Source package: [rust-gix-url]
Details (2)
0.28.2-1· amd64 · trixieAffected
pypi · rust-gix-url · debian · 13
0.28.2-1· arm64 · trixieAffected
pypi · rust-gix-url · debian · 13
[openSUSE Tumbleweed]
- [cargo-audit]Affected
Source package: [cargo-audit]
Details (1)
0.22.2~git0.281452c-2.1· x86_64 · tumbleweedAffected · Fixed:
0.22.2~git0.281452c-3.1pypi · cargo-audit · opensuse · tumbleweed
- [cargo-c]Affected
Source package: [cargo-c]
Details (1)
0.10.23-2.1· x86_64 · tumbleweedAffected · Fixed:
0.10.25-1.1pypi · cargo-c · opensuse · tumbleweed
Observed: