CVE-2026-82254 — gitoxide before 0.69.0 Denial of Service via gix-pack

Affected: GitoxideLabs gitoxide

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.

GHSA-x494-mj8g-cj27 — gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

Affected: crates.io: gix-pack

### Summary

Multiple denial-of-service vectors in `gix-pack`: unchecked array indexing causes panics on crafted delta data, and uncapped attacker-controlled size headers enable OOM process kills. Both are triggered by malicious pack data received during clone/fetch.

### Details

**Bug 1: Unchecked array indexing in delta application (CWE-248)**

The `apply()` function in `gix-pack/src/data/delta.rs` (lines 33-87) reads delta instructions using unchecked `data[i]` indexing at 7 locations (lines 41, 45, 49, 53, 57, 61, 65). The command byte's bits indicate how many additional bytes follow, but if the delta data is truncated, the index panics:

```rust pub(crate) fn apply(base: &[u8], mut target: &mut [u8], data: &[u8]) -> Result<(), apply::Error> { let mut i = 0; while let Some(cmd) = data.get(i) { // first byte: safely checked i += 1; match cmd { cmd if cmd & 0b1000_0000 != 0 => { let (mut ofs, mut size): (u32, u32) = (0, 0); if cmd & 0b0000_0001 != 0 { ofs = u32::from(data[i]); // PANIC: no bounds check i += 1; } // ... 6 more unchecked data[i] at lines 45, 49, 53, 57, 61, 65 ```

Lines 83-84 use `assert_eq!` (not `debug_assert_eq!`) that panics in both debug and release builds:

```rust assert_eq!(i, data.len()); assert_eq!(target.len(), 0); ```

A second location in `parse_header_info()` (`gix-pack/src/data/entry/decode.…

Most recent entries from all

CVE-2026-82254 — gitoxide before 0.69.0 Denial of Service via gix-pack

GHSA-x494-mj8g-cj27 — gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data