CVE-2026-0810

Katalog CVE

CVSS 7.1 · High EPSS 0,21%

Kerentanan Incorrect Calculation of Multi-Byte String Length pada gitoxidelabs gix-date. Skor CVSS 3.1 7.1 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in gix-date. The `gix_date::parse::TimeBuf::as_str` function can generate strings containing invalid non-UTF8 characters. This issue violates the internal safety invariants of the `TimeBuf` component, leading to undefined behavior when these malformed strings are subsequently processed. This could potentially result in application instability or other unforeseen consequences.

Rincian

Terbit di NVD

26 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-135: Incorrect Calculation of Multi-Byte String Length
CWE-682: Incorrect Calculation

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-0810 advisory pihak ketiga
• https://rustsec.org/advisories/RUSTSEC-2025-0140.html advisory pihak ketiga
• https://github.com/GitoxideLabs/gitoxide/issues/2305 exploit · issue tracking
• https://bugzilla.redhat.com/show_bug.cgi?id=2427057 issue tracking
• https://crates.io/crates/gix-date product