CVE-2026-82254

Gitoxide before 0.69.0, the Rust implementation of Git, contains unchecked array indexing in its delta-application code and does not cap allocations driven by attacker-controlled size headers in gix-pack. An attacker who controls a pack stream — for example by hosting a malicious repository or tampering with a remote during clone or fetch — can trigger an unhandled panic or drive the process into unbounded memory allocation and an out-of-memory kill. The impact is denial of service only: the CVSS 4.0 vector shows high availability impact with no confidentiality or integrity impact, and no code execution. Anyone running applications or tooling built on gix/gix-pack versions below 0.69.0 that receive pack data from untrusted or network-accessible sources is affected. There is no known exploitation in the wild, no public proof of concept, and EPSS assigns only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade gitoxide and the gix/gix-pack crates to 0.69.0 or later. Restrict clone and fetch operations to trusted remotes where feasible, and monitor processes that consume untrusted pack data for abrupt panics or memory-exhaustion kills. Rust applications with pinned gix dependencies should be rebuilt against the patched release.