CVE:CVE-2011-1027
CNNVD:CNNVD-201103-256
cgit 0.8.3.5之前版本的cgit.cgi的html.c中的convert_query_hexchar函数中存在off-by-one错误漏洞。远程攻击者可以借助由无效16进制字符之后的%字符组成的字符串，导致拒绝服务（无限循环）。
solution:Upgrade lars_hjemli cgit to a higher version than 0.8.3.4,0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,and avoid the version (,0.8.3.4],0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3