{"id":12381,"date":"2026-09-04T18:54:19","date_gmt":"2026-09-04T10:54:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-82247"},"modified":"2026-09-04T18:54:19","modified_gmt":"2026-09-04T10:54:19","slug":"cve-2026-82247","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-82247","title":{"rendered":"CVE-2026-82247 [HIGH] &#8211; gitoxide&#8217;s gix-url crate ("},"content":{"rendered":"<p>gitoxide&#8217;s gix-url crate (&lt;= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat &#039;?&#039; or &#039;#&#039; as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport&#039;s HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form ?@ so that gitoxide sends the caller&#8217;s HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions &lt;= 0.49.0 (fixed in 0.58.1).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>gitoxide&#8217;s gix-url crate (<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12381","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}