CVE-2026-82254: gitoxide before 0.69.0 Denial of Service via gix-pack
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. The attacker must be able to provide crafted pack data to the affected gitoxide process during clone or fetch operations.
What is the operational impact of a successful attack?
A crafted pack can trigger a panic through unchecked array indexing or cause an out-of-memory process kill through attacker-controlled allocation sizes. The reported impact is denial of service; no confidentiality or integrity impact is listed.