gix-pack CVE-2026-109350

Exploitation requires the victim to initiate a fetch (or clone) operation against a remote the attacker controls or has compromised, and the attacker must serve a specially crafted thin pack whose OFS_DELTA entry carries a base_distance greater than the current pack_offset (preceded by a REF_DELTA referencing an existing object). The key LIMITING factor is this user/client interaction (UI:P): the flaw cannot be triggered unsolicited against a passive listener - the victim must voluntarily fetch from the malicious source. Impact is confined to crashing the fetch process (availability only); there is no code execution, data disclosure, or integrity impact. No authentication is required on the attacker's server side (PR:N), and any gitoxide-based client using gix-pack before 0.75.0 in its default fetch path is affected.

This is a genuine but bounded availability risk, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly captures the nature of the flaw: network-reachable, low complexity, no privileges, but requiring passive user interaction (a victim must initiate a fetch), with impact limited to availability (VA:H) - no confidentiality or integrity loss. CWE-617 (reachable panic/assertion) aligns with the description's 'triggers a panic ... that aborts the fetch.' There is NO EPSS score, NO CISA KEV listing, and NO public POC indicated in the input - so exploitation signals are absent: no public exploit identified at time of analysis. The 7.1 'high' rating is driven almost entirely by the clean availability impact and network vector, but the real-world risk is tempered by three factors: (1) impact is a crash of a single client fetch operation, not RCE or data loss; (2) the victim must voluntarily fetch from an attacker-controlled remote; and (3) the affected component is a specific Rust library (gix-pack) rather than ubiquitous infrastructure. Net: a legitimate patch-worthy DoS in dependency hygiene terms, but low urgency absent exploitation evidence. One cross-check note: the input mixes CVSS 4.0 metrics while CWE and description imply a client-side crash - this is internally consistent, no conflict detected.

A victim runs a gitoxide-based tool (e.g., a fetch/clone) against a repository hosted on an attacker-controlled or compromised remote. The malicious server responds with a crafted thin pack containing a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds pack_offset, causing a panic in LookupRefDeltaObjectsIter that aborts the fetch. No public exploit is identified at time of analysis, but the preconditions are simple and fully attacker-controlled on the server side.