CVE-2026-82250: gitoxide gix-packetline before 0.21.5 Denial of Service

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-28
Weakness: CWE-191

Description

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.

Affected products

GitoxideLabs gitoxide: before 0.21.5 — fixed in 0.21.5

How to fix

Upgrade to a fixed version: GitoxideLabs gitoxide 0.21.5. Check the vendor advisory for mitigations.

References

https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww
https://www.vulncheck.com/advisories/gitoxide-gix-packetline-before-0.21.5-denial-of-service

Get alerted when CVE-2026-82250 or the next vulnerability affects your stack