Executive brief
gitoxide is a Git implementation library used by development tools and CI/CD pipelines to clone and fetch repositories. A malicious Git server can send a specially crafted packet to crash any client performing a fetch operation, causing service disruptions without requiring authentication. This denial-of-service attack is particularly damaging in unattended automation scenarios where no human oversight prevents the attack.
Technical details
The vulnerability is an integer underflow (CWE-191) in gix-packetline's TextRef implementation (lib.rs line 199). When processing side-band packet lines, the code unconditionally accesses d[d.len() - 1] to strip a trailing newline, but fails to guard against empty payloads. An empty side-band packet causes d.len() to be 0, resulting in usize underflow to 18446744073709551615, triggering an index-out-of-bounds panic. The attack is pre-authentication and network-triggered: a malicious Git server or any attacker-controlled remote can send a crafted 0005 0x02 packet with empty payload during a normal fetch operation. The fix is available in version 0.21.5 and later, which guards the empty-slice case using methods like strip_suffix().
Affected products
- GitoxideLabs gix-packetline before 0.21.5
Timeline
- 2026-06-16: disclosed: GitHub Security Advisory GHSA-2vh6-hw4j-32ww published
- 2026-08-28: advisory: CVE-2026-82250 published
- 2026-06-16: patched: Fix available in version 0.21.5