Description

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T12:16:36.957Z",
  "pubdate": "2026-08-28T12:16:36.957Z",
  "executiveSummary": "The gitoxide gix-packetline library, specifically versions prior to 0.21.5, is susceptible to an index out of bounds panic vulnerability residing within its TextRef implementation.\nThis vulnerability is triggered during the processing of side-band packet lines that contain empty payloads.\nA malicious Git server can exploit this flaw by delivering a crafted side-band packet to a client during a fetch operation, resulting in an immediate process abort.\nThis constitutes a Denial of Service (DoS) attack, as it terminates the client application unexpectedly.\nThe attack does not require authentication and can be executed against any client performing a fetch from a malicious or compromised Git repository.\nThe risk is categorized as high for automated systems or services that rely on Git fetching, as it can cause significant service disruption without prior interaction with the attacker.",
  "technicalDetails": "The vulnerability originates in the TextRef implementation of the gitoxide gix-packetline library. The flaw is rooted in inadequate boundary checking when parsing side-band packet lines.\nSpecifically, when the library processes a side-band packet, it expects the payload to adhere to specific length constraints. If a malicious server transmits a side-band packet containing an empty payload (i.e., a packet that lacks the expected data content while still adhering to the side-band protocol structure), the logic in TextRef fails to validate the index before access.\nThis leads to an index out of bounds condition. In the Rust programming language, such an operation triggers a panic, which, unless explicitly caught and handled, causes the immediate termination of the current thread or the entire process.\nThe attack flow proceeds as follows: 1) The client initiates a fetch request to a malicious Git server. 2) During the communication handshake or data transfer phase, the server sends a crafted side-band packet designed with an empty payload. 3) The client's gix-packetline library receives this packet and passes it to the TextRef parsing routine. 4) The parser attempts to access a memory location relative to the payload size without ensuring the payload exists or meets minimum length requirements. 5) The underlying Rust runtime triggers a panic due to the invalid index operation. 6) The client process aborts, effectively halting the fetch operation.\nThis vulnerability is particularly dangerous because it bypasses application-layer security logic; the crash happens at the parsing layer before the client can validate the content of the data stream. Because the attack is triggered during the standard fetch process, no authenticated session is required to initiate the exploit. Any client configured to pull from a repository controlled by an adversary is susceptible. The post-exploitation impact is limited to a Denial of Service, as the process abort prevents further execution, yet the ability to crash client processes during automated CI/CD pipelines or background sync tasks poses a significant operational threat."
}