CVE-2024-35197

gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that appear to have come from the application, and potentially other harmful effects under limited circumstances. If Windows is not used, or untrusted repositories are not cloned or otherwise used, then there is no impact. A minor degradation in availability may also be possible, such as with a very large file named `CON`, though the user could interrupt the application.

• CWE-67

• https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9
• https://github.com/Byron/gitoxide/security/advisories/GHSA-49jc-r788-3fc9

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35190Asterisk is an open source private branch exchange and telep…5.3
• CVE-2024-35191Formie is a Craft CMS plugin for creating forms. Prior to 2.…4.4
• CVE-2024-35192Trivy is a security scanner. Prior to 0.51.2, if a malicious…5.5
• CVE-2024-35194Minder is a software supply chain security platform. Prior t…5.3
• CVE-2024-35195Requests is a HTTP library. Prior to 2.32.0, when making req…5.6
• CVE-2024-35196Sentry is a developer-first error tracking and performance m…2
• CVE-2024-35198TorchServe is a flexible and easy-to-use tool for serving an…9.8
• CVE-2024-35199TorchServe is a flexible and easy-to-use tool for serving an…8.2
• CVE-2024-3520The Country State City Dropdown CF7 plugin for WordPress is …4.3
• CVE-2024-35200When NGINX Plus or NGINX OSS are configured to use the HTTP/…5.3
• CVE-2024-35201Incorrect default permissions in the Intel(R) SDP Tool for W…7.8
• CVE-2024-35202Bitcoin Core before 25.0 allows remote attackers to cause a …7.5