CVE-2026-82250: gitoxide gix-packetline before 0.21.5 Denial of Service
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gitoxide gix-packetlineto a version that resolves this vulnerability.Fixed in 0.21.5 - Compensating control
Mitigate the fetch-operation DoS risk by preventing untrusted or malicious Git servers from being contacted by clients (e.g., restrict allowed Git remote hosts via network controls/ACLs) until gix-packetline is upgraded to 0.21.5 or later.
Event History
Frequently Asked Questions
Who is exposed to this denial of service?
Clients using gix-packetline before 0.21.5 are exposed when they perform fetch operations against a malicious Git server. Exploitation does not require authentication, but it requires the user or automated client to interact with the malicious server.
What is the practical impact of successful exploitation?
A crafted side-band packet line with an empty payload can cause an index-out-of-bounds panic in the TextRef implementation. This aborts the affected client process, resulting in a denial of service for the fetch operation.
What is the remediation?
Upgrade gix-packetline to version 0.21.5 or later. Until upgrading is possible, avoid fetching from untrusted or potentially malicious Git servers.