Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-82250: gitoxide gix-packetline fetch can crash client
CVE-2026-82250 · published 2 months ago
Summary
Older versions of the gitoxide gix-packetline component may stop working when a Git server sends a specially crafted data packet with no content. This can cause the client program to shut down abruptly during a fetch operation, potentially interrupting work. Updating to version 0.21.5 or newer resolves the issue.
What to do
- Update gix-packetline to version 0.21.5.
- Update debian rust-gix-packetline to version 0.22.0-1.
- Update gitoxidelabs gitoxide to version 0.21.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | gitoxidelabs | gitoxide | < 0.21.5 |
| rust | – | gix-packetline |
<= 0.21.4 Fix: upgrade to 0.21.5
|
| Debian:13 | debian | rust-gix-packetline | All versions |
| Debian:14 | debian | rust-gix-packetline |
< 0.22.0-1 Fix: upgrade to 0.22.0-1
|
| Ubuntu:24.04:LTS | canonical | rust-gix-packetline | All versions |
Original advisory text
gitoxide gix-packetline before 0.21.5 Denial of Service
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.
References
- https://security-tracker.debian.org/tracker/CVE-2026-82250 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82250... Vendor Advisory
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-82250 Vendor Advisory
- https://www.vulncheck.com/advisories/gitoxide-gix-packetline-before-0.21.5-denia... Third Party Advisory
- https://github.com/GitoxideLabs/gitoxide/pull/2638
- https://github.com/GitoxideLabs/gitoxide/commit/4bef04ae8a261634200b3a6faabdd77e...
- https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-packetline-v0.21.5
- https://github.com/advisories/GHSA-2vh6-hw4j-32ww
- https://ubuntu.com/security/CVE-2026-82250 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-82250 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
8.3
High
Type
CWE-191Integer Underflow (Wrap or Wraparound)
Timeline
Published28 Aug 2026
Updated4 Nov 2026
First seen28 Aug 2026
Sources
CVE-2026-82250 · NVD
CVE-2026-82250 · MITRE
DEBIAN-CVE-2026-82250 · OSV
CVE-2026-82250 · OSV
GHSA-2vh6-hw4j-32ww · GHSA
UBUNTU-CVE-2026-82250 · OSV
Track software like this
Free during beta