CVE-2026-109350: Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistance exceeds packoffset, triggering a panic in LookupRefDeltaObjectsIter that aborts the fetch process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application using gix-pack before 0.75.0 that fetches from a malicious or attacker-controlled Git remote is exposed. The attacker can deliver the crafted thin pack over the network during the fetch operation.
What does an attacker need to exploit it?
The attacker needs to control a Git remote or otherwise cause the affected application to fetch a crafted thin pack. No authentication or other privileges are indicated, but user interaction is required because a fetch must be initiated.
What is the impact of a successful exploit?
The crafted OFS_DELTA entry triggers a panic in LookupRefDeltaObjectsIter, aborting the fetch process. The reported impact is denial of service; no confidentiality or integrity impact is stated.
What should be done if immediate upgrading is not possible?
Avoid fetching from untrusted or attacker-controlled remotes until gix-pack can be updated to version 0.75.0 or later. This limits an attacker's ability to supply the malformed thin pack required to trigger the panic.