CVE-2026-82250

EUVD-2026-67702
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.
Wrap or Wraparound
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.28%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gitoxidelabsgitoxide
𝑥
< 0.21.5
CNA
Debian logo
Debian Releases
Debian Product
Codename
rust-gix-packetline
forky
vulnerable
sid
0.22.0-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww
https://www.vulncheck.com/advisories/gitoxide-gix-packetline-before-0.21.5-denial-of-service