{"action":"Upgrade gix-transport to 0.56.0 or later.","affected":[{"fixed":"0.56.0","introduced":"0.25.4"}],"component":"gix-transport","cve_ids":["CVE-2026-82255"],"ecosystem":"crates.io","epss":0.00384,"exploited":false,"fixed_versions":["0.56.0"],"ghsa_id":"GHSA-9857-6mw7-fq2m","id":"tcs_01M5KEW8W3THF6C0PC1ZZXQ9E3","modified_at":"2026-10-01T03:56:08.037992750Z","published_at":"2026-05-05T19:16:35Z","references":["https://osv.dev/vulnerability/GHSA-9857-6mw7-fq2m","https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-9857-6mw7-fq2m","https://github.com/GitoxideLabs/gitoxide"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-9857-6mw7-fq2m","url":"https://osv.dev/vulnerability/GHSA-9857-6mw7-fq2m"}],"summary":"gix-transport: HTTP credentials leaked to redirected host in curl backend"}