gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

A vulnerability in gitoxide's gix-url crate (versions <= 0.32.0, fixed in 0.37.1) involves a hand-rolled URL parser that incorrectly handles '?' and '#' characters, failing to treat them as terminators for the authority component as required by RFC 3986. This flaw causes gix-transport's HTTP redirect identity guard (can_reuse_identity) to compare incorrect host values, causing it to fail open. An attacker who can control HTTP redirect responses can craft a malicious Location header in the form of attacker-authority?@original-authority, tricking gitoxide into forwarding the caller's HTTP Basic Authorization credentials to an unintended, attacker-controlled host. The gix-transport crate is affected in versions <= 0.49.0, with a fix available in version 0.58.1. This represents a credential leakage risk for any application using gitoxide to interact with remote Git repositories over HTTP. Users should upgrade to the fixed versions immediately to mitigate the risk of credential theft.