gitoxide gix-pack CVE-2026-109349

Exploitation requires the victim to initiate a git clone or fetch (the smart/pack transfer path) against an attacker-controlled or compromised remote using a gix-pack version before 0.75.0; the attacker simply responds with a crafted 12-byte pack header whose version field is 3. No authentication and no special target-side configuration are needed (PR:N). The principal limiting factor is the required user-initiated action (UI:P/UI:R): the attacker cannot reach a passive victim and must induce the client to pull from a malicious remote, which narrows realistic exposure to environments that fetch from untrusted sources (e.g., automated CI, dependency resolution, or mirrors).

This is a denial-of-service vulnerability (CWE-617, reachable assertion) with a provided CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H). The network attack vector, low complexity, and no-privileges requirement make it easy to trigger, but impact is limited strictly to availability (VA:H; VC/VI:N) - there is no code execution, data disclosure, or integrity loss, only a client-side panic that aborts a clone or fetch. The signals are notably consistent rather than conflicting: no EPSS score, KEV status, or POC flag was supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' A key mitigating factor is that exploitation is not server-side or self-propagating - it requires the victim to initiate a git operation against an attacker-controlled remote (reflected in UI:P/UI:R). This is therefore a genuine but bounded risk: a crash/abort of client tooling, not a high-urgency RCE. Priority should be moderate - patch in the normal cycle, elevated only where gix-pack-based clients fetch from untrusted or user-supplied remotes (e.g., CI pulling arbitrary dependencies).

An attacker stands up or compromises a git remote and waits for (or lures) a victim to clone or fetch from it. When the gix-pack-based client requests pack data, the malicious server returns a 12-byte pack header declaring version 3; the decoder accepts the version but a release-enabled assert_eq! expecting version 2 fires, panicking the client and aborting the operation. No public exploit code was identified at time of analysis, though the trigger is a trivially crafted 12-byte header.