SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-82247

HIGH · CVSS 7.5 EPSS 0.30% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-28 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The gix-url crate in gitoxide versions up to 0.32.0 is vulnerable due to a flawed URL parser that improperly handles '?' and '#' characters, allowing attackers to manipulate HTTP redirects. This flaw can lead to unauthorized exposure of HTTP Basic Authorization credentials to unintended hosts, posing a significant security risk. Organizations using affected versions of gix-transport (up to 0.49.0) should prioritize updating to version 0.58.1 to mitigate this vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-82247
Severity
HIGH
CVSS
7.5
EPSS
0.30%

Original NVD Description

gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).