Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

gix-packetline

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5crates.ioAmendedPublished

    gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

    CVE-2026-82250 · GHSA-2vh6-hw4j-32ww

    Affected
    • crates.io gix-packetline <= 0.21.4
    Fixed in
    0.21.5· Vendor fix available
    Issue
    gix-packetline panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the gix client process during a normal fetch. This is a pre-authentication, network-triggered denial of service. Details In gix-packetline/src/lib.rs, impl From<&[u8] for TextRef strips a trailing newline with d[d.len() - 1]: https://github.com/GitoxideLabs/gitoxide/blob/eac50e1207e2549b23302c9faf595a420b9919fc/gix-packetline/src/lib.rs#L199 When d is empty (an empty side-band payload after the band-id byte is removed), d.len() - 1 underflows usize (to 18446744073709551615, i.e. 0 - 1) and the index access panics. The empty side-band line is attacker-supplied and is reached during a normal fetch. (Related: an unchecked splitatmut in gix-packetline/src/blockingio/read.rs is in the same DoS class and worth hardening in the same pass.) PoC Confirmed against gix v0.54.0 (crate…

    Recommended action: Upgrade to 0.21.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →