Description

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T12:16:38.173Z",
  "pubdate": "2026-08-28T12:16:38.173Z",
  "executiveSummary": "The vulnerability identified in gitoxide versions prior to 0.69.0 involves critical memory safety and resource management flaws within the gix-pack component.\nThe issues consist of unchecked array indexing during delta application and the failure to enforce bounds on memory allocations triggered by attacker-controlled size headers.\nThese vulnerabilities allow a remote attacker to induce process panics or trigger out-of-memory (OOM) conditions through maliciously crafted pack data.\nThe impact is primarily a Denial of Service (DoS) capability, which can be leveraged during standard git operations such as 'clone' or 'fetch'.\nExploitation requires the attacker to successfully influence the data stream transmitted to a client or server utilizing the affected gitoxide libraries.\nGiven that gitoxide is often integrated into performance-critical infrastructure, an OOM kill induced by arbitrary pack data poses a significant risk to service availability.\nNo authentication is required to initiate the vulnerable operations, as the flaws reside in the packet processing logic encountered during the repository synchronization phase.",
  "technicalDetails": "The vulnerability resides within the gix-pack crate of the gitoxide ecosystem, specifically affecting the logic responsible for parsing and applying delta-encoded git objects.\nThe first flaw concerns the lack of bounds checking during the application of deltas. When reconstructing objects from pack files, the code performs array indexing based on offsets derived from the pack data. Without proper validation of these indices against the actual buffer size, the application enters an out-of-bounds access state, leading to a deliberate panic in Rust, effectively crashing the runtime process.\nThe second flaw involves improper resource allocation practices. The gix-pack component parses size headers directly from incoming pack data. If the header specifies an excessively large size, the application attempts to allocate memory corresponding to this value without verifying it against available system resources or predefined sanity limits. By sending a crafted pack stream with inflated size headers, an attacker forces the application to perform massive allocations, which triggers the operating system's OOM killer to terminate the process.\nThe attack flow proceeds as follows: An attacker initializes a network connection to an affected gitoxide instance or acts as a malicious remote during a fetch/clone operation. The attacker delivers a crafted packfile stream containing invalid delta instructions or malicious object headers. As the gitoxide client or server parses the incoming stream, the gix-pack logic processes the malicious offsets or size headers. The unchecked indexing causes an immediate panic, while the unchecked allocation leads to memory exhaustion. This results in the abrupt termination of the process, preventing further operations and disrupting service availability.\nThese vulnerabilities do not require specific authentication, as the processing of pack files occurs during the early stages of git protocol communication. The flaws represent a failure in input sanitization and secure resource management within the library's internal parsing routines. Because the library is designed for high-performance object processing, the reliance on raw offsets and header values without rigorous validation creates a vector for remote exploitation.\nAffected versions include all releases of gitoxide prior to 0.69.0. Impacted components primarily include the pack traversal and delta application logic within gix-pack. Successful exploitation results in complete service interruption for the affected git client or server."
}