CVE-2026-109349: gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a release-enabled asserteq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gix-packto a version that resolves this vulnerability.Fixed in 0.75.0
Event History
Frequently Asked Questions
Who can trigger the denial of service?
A malicious remote can trigger it against a client using an affected gix-pack version by sending a 12-byte pack header that declares pack version 3 during a clone or fetch.
What conditions are required for exploitation?
The issue is remotely reachable and requires no attacker privileges, but it requires user interaction: the client must initiate a clone or fetch from the malicious remote.
What is the impact on the client?
The reachable assertion panics the client, aborting the clone or fetch operation. The reported impact is availability only; no confidentiality or integrity impact is indicated.
Which versions should be remediated?
gix-pack versions before 0.75.0 are affected. Update to version 0.75.0 or later.