EUVD-2026-97653
GHSA-hf39-hrp5-hx3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to clone/fetch from malicious remote
-
DeliveryRemote serves 12-byte pack header
-
ExploitHeader claims 0xFFFFFFFF object count
-
ExecutionTree::with_capacity reserves hundreds of GB
-
ImpactClone/fetch process aborts (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must actively initiate a clone or fetch (UI:P/UI:R) against an attacker-controlled or malicious Git remote running a tool that uses gix-pack before 0.75.0 - exploitation cannot be pushed to a passive victim. No authentication is required of the attacker (PR:N), and default configurations are affected since the flaw is in the core pack-header parsing path. Limiting factors: exploitation depends entirely on the victim connecting to an untrusted/malicious remote, and the impact is restricted to crashing the client process (availability only) with no code execution or data exposure. |
| Impact | This is a moderate, availability-only denial-of-service issue rather than a top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, base 7.1) shows a network-reachable, low-complexity, unauthenticated flaw, but with UI:P - exploitation is passive-interaction-dependent: the victim must themselves initiate a clone or fetch against an attacker-controlled remote. Impact is confined to availability (VA:H); there is no confidentiality or integrity exposure (VC:N/VI:N), consistent with CWE-770 uncontrolled resource consumption. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so real-world exploitation signals are absent - no public exploit identified at time of analysis. The signals are internally consistent (DoS-only, requires victim action), so there is no network-vs-local or auth conflict to flag; the main caveat is that EPSS/KEV/POC data is simply missing rather than low, so widespread exploitation cannot be ruled in or out. Net: a credible crash/DoS risk for anyone fetching from untrusted remotes with a vulnerable gix-pack, but not a drop-everything issue given the DoS-only impact and the required user-initiated connection. |
| Exploit ScenarioDerived | An attacker stands up a malicious Git remote (or compromises/typosquats one) and waits for or lures a victim into running clone or fetch against it using a tool built on gix-pack < 0.75.0. The remote returns a 12-byte pack header declaring 0xFFFFFFFF objects, causing Tree::with_capacity to attempt to reserve hundreds of gigabytes and abort the process. No public exploit code is identified in the provided data, but the technique is fully described and trivially reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
RemediationAI
Upgrade the gix-pack crate to version 0.75.0 or later, which is the vendor-released fixed version; consumers should refresh Cargo.lock and rebuild any downstream application that depends on the crate, following the advisory at https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x862-c2wj-4mwr. Until the upgrade is applied, the practical compensating control is to avoid cloning or fetching from untrusted or attacker-supplied Git remotes, since exploitation requires the victim to initiate the connection; for automation that must fetch untrusted remotes, run the fetch inside a cgroup or container with a hard memory cap so the oversized allocation is contained and only the fetching process is lost rather than the host, accepting the trade-off that legitimately large repositories may also fail under the same cap. Applying an address-space limit such as ulimit -v to the fetching process provides similar containment with the same risk of aborting valid large clones. No workaround that preserves the ability to fetch from arbitrary untrusted remotes is documented in the available advisories.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
gix-pack is the Rust packfile handling crate of the Gitoxide project, an independent Git implementation. A Git packfile starts with a 12-byte header consisting of the 'PACK' signature, a 4-byte version field, and a 4-byte big-endian object count. CWE-770 (Allocation of Resources Without Limits or Throttling) is the root cause: the parser passes the attacker-controlled object count directly into Tree::with_capacity, pre-allocating an index sized for the claimed entries. A header claiming 0xFFFFFFFF objects therefore triggers an allocation request on the order of hundreds of gigabytes, which typically fails or aborts the process, yielding an availability-only impact. Because the count field is trusted before any real pack data is read, only the header needs to be attacker-controlled, so no authentication or repository access is involved.
Know when Gix Pack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable during clone/fetch with no attacker privileges, but the victim must initiate the connection to a malicious remote (UI:R); only availability is affected (process abort).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::with_capacity to reserve hundreds of gigabytes and crash clone or fetch operations.
Technical POC Analysis
Bug class: CWE-770 (Allocation of Resources Without Limits or Throttling).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Gitoxide's gix-pack crate versions before 0.75.0 are vulnerable to a denial-of-service attack that can crash developer clone or fetch operations when interacting with a malicious remote repository. This requires a user to initiate the operation, and no public exploit identified at time of analysis, with no vendor-released patch identified at time of analysis. While it does not lead to data exposure or code execution, it can disrupt development workflows and should be prioritized for mitigation.
Restrict Git operations to trusted repositories, implement memory limits on processes, avoid cloning from untrusted remotes, and consider using alternative Git clients for untrusted operations. Monitor vendor advisories for a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or com
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone o
Exploit-DB