Executive brief
The gix-packetline library, used by the gix Git client, crashes when processing specially-crafted Git protocol packets with empty payloads. An attacker operating a malicious Git server can trigger this crash during a normal clone or fetch operation, causing the client process to abort without any authentication required. This affects automated systems (CI/CD pipelines, backup tools) that fetch from untrusted or compromised repositories.
Technical details
The vulnerability is an integer underflow (CWE-191) in the TextRef parsing code (gix-packetline/src/lib.rs, line 199). When processing Git protocol side-band packets, the code attempts to strip a trailing newline by unconditionally accessing `d[d.len() - 1]` without first checking if the slice is non-empty. If a side-band packet contains only the 1-byte band-id with no payload, `d` becomes an empty slice after band-id removal, causing `d.len() - 1` to underflow from 0 to the maximum usize value (18446744073709551615), which triggers an out-of-bounds panic. The attack vector is network-based with no authentication required; an attacker can serve a malicious Git server or intercept/modify Git protocol traffic. The fix involves guarding against empty slices before indexing, e.g., `d.strip_suffix(b"\n").unwrap_or(d)` or checking `!d.is_empty()` before accessing `d[d.len() - 1]`. Patched in version 0.21.5.
Affected products
- GitoxideLabs gix-packetline <= 0.21.4
Timeline
- 2026-06-16: disclosed: GitHub advisory published
- 2026-06-16: patched: Version 0.21.5 released with fix
- 2026-08-28: advisory: Added to GitHub Advisory Database