Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File
CVE-2026-123533
Summary
Mariner
Products covered
azl3 azurelinux-image-tools 1.6.0-2 on Azure Linux 3.0
azl3 cert-manager 1.12.15-12 on Azure Linux 3.0
azl3 containerd2 2.2.4-8 on Azure Linux 3.0
azl3 docker-buildx 0.14.0-16 on Azure Linux 3.0
azl3 etcd 3.5.33-1 on Azure Linux 3.0
azl3 flannel 0.24.2-31 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-20 on Azure Linux 3.0
azl3 kube-vip-cloud-provider 0.0.10-8 on Azure Linux 3.0
Show 33 more products
azl3 moby-containerd-cc 1.7.7-16 on Azure Linux 3.0
azl3 moby-engine 25.0.3-20 on Azure Linux 3.0
azl3 prometheus-adapter 0.12.0-9 on Azure Linux 3.0
azl3 azurelinux-image-tools 1.6.0-3 on Azure Linux 3.0
azl3 docker-compose 2.27.0-14 on Azure Linux 3.0
azl3 flannel 0.24.2-32 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-21 on Azure Linux 3.0
azl3 keda 2.14.1-19 on Azure Linux 3.0
azl3 kubernetes 1.30.10-30 on Azure Linux 3.0
azl3 cloud-provider-kubevirt 0.5.1-7 on Azure Linux 3.0
azl3 cri-tools 1.32.0-7 on Azure Linux 3.0
azl3 docker-compose 2.27.0-13 on Azure Linux 3.0
azl3 kata-containers 3.32.0.kata0-5 on Azure Linux 3.0
azl3 keda 2.14.1-18 on Azure Linux 3.0
azl3 kubernetes 1.30.10-29 on Azure Linux 3.0
azl3 cert-manager 1.12.15-14 on Azure Linux 3.0
azl3 cloud-provider-kubevirt 0.5.1-9 on Azure Linux 3.0
azl3 containerd2 2.3.4-1 on Azure Linux 3.0
azl3 cri-tools 1.32.0-8 on Azure Linux 3.0
azl3 docker-buildx 0.14.0-17 on Azure Linux 3.0
azl3 kata-containers 4.1.0.kata0-1 on Azure Linux 3.0
azl3 kube-vip-cloud-provider 0.0.10-10 on Azure Linux 3.0
azl3 moby-containerd-cc 1.7.7-17 on Azure Linux 3.0
azl3 prometheus-adapter 0.12.0-10 on Azure Linux 3.0
azl3 cloud-provider-kubevirt 0.5.1-10 on Azure Linux 3.0
azl3 containerd2 2.3.7-1 on Azure Linux 3.0
azl3 cri-tools 1.32.0-10 on Azure Linux 3.0
azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0
azl3 kubernetes 1.30.10-32 on Azure Linux 3.0
azl3 moby-containerd-cc 1.7.7-19 on Azure Linux 3.0
azl3 moby-engine 25.0.18-1 on Azure Linux 3.0
azl3 prometheus-adapter 0.12.0-12 on Azure Linux 3.0
Remediation
Release Notes
Vendor-listed fixes
3.5.35-1
1.7.0-2
2.27.0-16
0.24.2-34
3.15.0.aks0-23
1.12.15-15
2.4.0-1
0.14.0-19
Show 4 more fixes
4.1.0.kata1-2
0.0.10-11
1.7.7-19
2.3.7-1
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Added affected products: azl3 cloud-provider-kubevirt 0.5.1-10 on Azure Linux 3.0, azl3 containerd2 2.3.7-1 on Azure Linux 3.0, azl3 cri-tools 1.32.0-10 on Azure Linux 3.0, azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0, azl3....
- Added fixed versions: 1.7.7-19, 2.3.7-1, 3.15.0.aks0-23, 4.1.0.kata1-2.
- Added fixed versions: 3.5.35-1.
- Added fixed versions: 0.0.10-11, 0.14.0-19, 0.24.2-34, 1.7.0-2, 1.12.15-15.
- Removed fixed versions: 1.7.0-1.
- Removed affected products: azl3 opa 0.63.0-5 on Azure Linux 3.0.
- Added fixed versions: 2.4.0-1.
- Added fixed versions: 1.7.0-1.
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Updated by Microsoft Security Response Center
The vendor changed the advisory after it was first published.
- Confirmed at the source
Our collector saw this advisory during a later source check.