[Pkg-rust-maintainers] Bug#1150810: rust-gix-mailmap: CVE-2026-109348

[Moritz Mühlenhoff]

Source: rust-gix-mailmap
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rust-gix-mailmap.

CVE-2026-109348[0]:
| Gitoxide gix-mailmap before 0.35.0 contains a denial of service
| vulnerability that allows attackers to exhaust CPU through
| quadratic-time parsing in Snapshot::from_bytes. Attackers can commit
| a crafted .mailmap with descending-ordered entries forcing repeated
| front inserts, blocking workers running log, blame, or shortlog for
| minutes.

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmpw-wwcm-r8rc


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-109348
    https://www.cve.org/CVERecord?id=CVE-2026-109348

Please adjust the affected versions in the BTS as needed.