CVE-2026-82254: gitoxide DOS Vulnerability via Pack Data

CVE-2026-82254 Overview

CVE-2026-82254 is a denial-of-service vulnerability in gitoxide, a pure Rust implementation of Git. Versions prior to 0.69.0 contain unchecked array indexing during delta application and uncapped memory allocation from attacker-controlled size headers in the gix-pack component. An attacker can serve crafted Git pack data during a clone or fetch operation to trigger a process panic or an out-of-memory kill. The flaw is tracked under [CWE-248: Uncaught Exception] and requires no authentication or user interaction beyond initiating a normal Git operation against a hostile remote.

Critical Impact
Any client or automated system that clones or fetches from an untrusted Git remote using vulnerable gitoxide versions can be forced to crash, disrupting CI/CD pipelines, mirroring services, and developer tooling.

Affected Products

gitoxide versions prior to 0.69.0
The gix-pack crate consumed by downstream Rust applications
Any tooling embedding vulnerable gitoxide for clone or fetch operations

Discovery Timeline

2026-08-28 - CVE-2026-82254 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82254

Vulnerability Analysis

The vulnerability resides in the gix-pack crate, which parses Git packfile data during network operations. Two defects combine to produce the denial-of-service condition. First, delta application performs array indexing without bounds validation, so a malformed delta instruction can index outside the source buffer and cause a Rust panic. Second, size headers embedded in the packfile are treated as trustworthy inputs to allocation routines. A remote can declare an arbitrarily large object size and cause gitoxide to request memory that the operating system cannot satisfy, ending in an out-of-memory kill.

Because pack negotiation happens on every clone and fetch, exploitation does not require authentication or write access. The impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is missing input validation on data structures parsed from remote packfiles. Array offsets used during delta reconstruction are not checked against the length of the base object, and allocation sizes derived from pack headers are not capped against a sane upper bound.

Attack Vector

An attacker hosts a malicious Git repository or performs a man-in-the-middle attack on an unauthenticated Git protocol session. When a victim client uses a gitoxide-based tool to clone or fetch from the attacker-controlled endpoint, the crafted pack stream is delivered during the fetch-pack exchange. The client process then either panics on the invalid delta or is terminated by the kernel OOM killer while attempting to allocate memory for the falsified object size.

Exploitation details are described in the GitHub Security Advisory GHSA-x494-mj8g-cj27 and the VulnCheck Denial of Service Advisory.

Detection Methods for CVE-2026-82254

Indicators of Compromise

Unexpected process termination of gitoxide-based binaries during clone or fetch operations, often with Rust panic traces referencing gix-pack delta application.
Kernel OOM-killer log entries for Git client processes shortly after network activity to an external Git remote.
Repeated crash loops in CI/CD runners that pull from a specific upstream repository or mirror.

Detection Strategies

Inventory Rust projects and binaries that depend on gix-pack or gitoxide and flag versions below 0.69.0.
Monitor endpoint telemetry for abnormal termination of Git tooling paired with outbound TCP traffic on ports 9418, 443, or 22 to non-corporate destinations.
Correlate build pipeline failures with the remote URL of the fetch step to identify hostile upstreams.

Monitoring Recommendations

Alert on crash events for developer and CI processes that include the strings gix-pack, panicked at, or killed in stderr logs.
Track memory-pressure and cgroup OOM events on build agents that regularly perform Git fetches.
Log the resolved URL and remote host for every clone and fetch executed on shared infrastructure.

How to Mitigate CVE-2026-82254

Immediate Actions Required

Upgrade all gitoxide installations and dependent Rust crates to version 0.69.0 or later.
Rebuild and redeploy internal tools, container images, and CI runners that statically link older gix-pack versions.
Restrict clone and fetch operations to trusted, authenticated Git remotes until patching is complete.

Patch Information

The issue is fixed in gitoxide 0.69.0. Refer to the GitHub Security Advisory GHSA-x494-mj8g-cj27 for the list of patched crates and version constraints to apply in Cargo.toml.

Workarounds

Route Git fetches through an internal caching proxy or mirror that only pulls from vetted upstreams.
Run gitoxide-based tooling inside memory-limited sandboxes so an OOM condition affects only the isolated process, not the host.
Disable automated fetches from external repositories in CI/CD pipelines until upgrades are validated.

bash

# Configuration example
# Pin gitoxide to a fixed version in Cargo.toml
[dependencies]
gitoxide = ">=0.69.0"
gix-pack = ">=0.69.0"

# Verify installed version
cargo tree -i gitoxide
cargo tree -i gix-pack