Denial of Service Vulnerability in Gitoxide gix-packetline
CVE-2026-82250

7.1HIGH

Key Information:

Vendor

Gitoxidelabs

Status
Gitoxide
Vendor
CVE Published:
28 August 2026

What is CVE-2026-82250?

A vulnerability exists in Gitoxide's gix-packetline prior to version 0.21.5, where a malicious Git server can exploit the TextRef implementation by sending crafted side-band packets with empty payloads. This action may trigger an index out of bounds panic, resulting in an abrupt termination of the client process during fetch operations, without requiring any form of authentication. As a result, users are advised to upgrade to the latest version to mitigate this risk.

Affected Version(s)

gitoxide 0 < 0.21.5

gitoxide 0.21.5

References

https://github.com/GitoxideLabs/gitoxide/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/gitoxide-gix-packetl...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

KutalVolkan
.