CVE-2026-82250

The gix-packetline crate, which implements the Git packet-line wire protocol for the Rust-native gitoxide project, contains a panic vulnerability (classified CWE-191) in its TextRef implementation when handling side-band packet lines with empty payloads. A malicious or compromised Git server can send a crafted side-band packet during a fetch, causing an index-out-of-bounds panic that aborts the connecting client process; no authentication is required, though the victim must initiate a fetch against the attacker-controlled server. The impact is denial of service — the fetch operation fails and the client crashes — with no confidentiality or integrity impact per the CVSS vector (VA:H, VC/VI:N). Affected are any users of the gitoxide CLI and any Rust applications embedding gix-packetline in versions before 0.21.5 when cloning or fetching from untrusted remotes. There is no evidence of active exploitation: no public proof-of-concept, not in CISA KEV, and EPSS is 0.2% (14th percentile).

What to do: Upgrade gix-packetline to 0.21.5 or later, or update any gix/gitoxide-dependent applications to releases that bundle the fixed crate; audit Cargo.lock for gix-packetline versions below 0.21.5. Until patched, avoid cloning or fetching from untrusted or potentially compromised Git servers with gix-based clients. No public PoC or KEV listing currently indicates urgent risk.