gitoxide gix-packetline CVE-2026-82250

The victim client must initiate a Git fetch or clone operation against a server controlled or influenced by the attacker. No authentication is required on the attacker's side - operating any Git-speaking server endpoint is sufficient. The client process must be running a version of gitoxide/gix-packetline earlier than 0.21.5. Exploitation is limited by the UI:P requirement: the victim must actively connect to the malicious server, ruling out purely passive or unsolicited attacks. Environments that only fetch from a fixed, trusted set of Git remotes (e.g., internal Gitea, GitHub Enterprise on an allowlist) are not reachable by this attack vector. The panic produces a DoS with no memory corruption, so exploitation cannot escalate to code execution on the client.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VA:H) accurately captures the threat model: network-reachable, low complexity, no server-side privileges required, but dependent on the victim initiating a fetch (UI:P). The sole confirmed impact is high availability loss to the vulnerable system (VA:H); confidentiality and integrity are unaffected (VC/VI/SC/SI/SA all N). No EPSS data was supplied and no KEV listing exists, placing this in the 'monitor and patch' tier rather than emergency response. The attack surface is constrained to clients that fetch from untrusted or attacker-controlled Git servers - a scenario common in CI pipelines, package mirrors, and developer workstations that clone arbitrary repositories. The tags supplied ('Information Disclosure', 'Integer Overflow') are misleading: the description and CVSS confirm availability-only impact and an underflow (CWE-191), not overflow or disclosure. No conflicting signals between CVSS vector and description were identified.

An attacker operates or compromises a Git server and waits for a target running a vulnerable gitoxide-based client to initiate a fetch or clone. During the protocol handshake, the server sends a side-band packet with an empty payload. The gix-packetline TextRef parser underflows on the empty payload, the Rust runtime panics, and the client process terminates immediately - aborting any ongoing CI pipeline, package resolution, or developer workflow that depended on the fetch completing. No exploit code is publicly known at time of analysis, but the primitive is straightforward to reproduce given the advisory description.