Gix Pack
Monthly
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or compromised remote abort a client's fetch or clone by serving a malformed thin pack. The crafted pack combines a REF_DELTA that points at an already-known object with a following OFS_DELTA whose base_distance exceeds the current pack_offset, which drives the LookupRefDeltaObjectsIter into an arithmetic boundary it cannot satisfy and causes a panic that terminates the fetch process. The attack is unauthenticated from the attacker's side (PR:N) but requires user interaction (UI:P/UI:R): the victim must voluntarily fetch from or clone the attacker's repository, so it cannot be triggered against a passive listener. Impact is limited to availability of the fetch operation - no code execution, data disclosure, or integrity impact - and no public exploit code has been identified at time of analysis.
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone or fetch by responding with a crafted 12-byte pack header declaring version 3, which trips a release-enabled assert_eq! in BytesToEntriesIter::new_from_header that expects version 2. The attack requires the victim to initiate the fetch from an attacker-controlled or compromised remote (UI:R), but no authentication is needed (PR:N); automated CI, dependency resolution, or mirror synchronization that pulls from untrusted sources is the primary exposure. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 score is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H per independent assessment).
Denial of service in the Gitoxide gix-pack crate before 0.75.0 allows a remote attacker operating a malicious Git remote to crash a victim's clone or fetch operation by advertising an absurd pack-header object count, forcing the client to reserve hundreds of gigabytes of memory. Exploitation requires the victim to initiate the clone or fetch against the untrusted remote (user interaction), and no authentication is required of the attacker; the flaw sits in the default pack-header parsing path, so unmodified configurations are affected. The impact is limited to killing the client process with no code execution or data exposure, and no public exploit code was identified at time of analysis.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or compromised remote abort a client's fetch or clone by serving a malformed thin pack. The crafted pack combines a REF_DELTA that points at an already-known object with a following OFS_DELTA whose base_distance exceeds the current pack_offset, which drives the LookupRefDeltaObjectsIter into an arithmetic boundary it cannot satisfy and causes a panic that terminates the fetch process. The attack is unauthenticated from the attacker's side (PR:N) but requires user interaction (UI:P/UI:R): the victim must voluntarily fetch from or clone the attacker's repository, so it cannot be triggered against a passive listener. Impact is limited to availability of the fetch operation - no code execution, data disclosure, or integrity impact - and no public exploit code has been identified at time of analysis.
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone or fetch by responding with a crafted 12-byte pack header declaring version 3, which trips a release-enabled assert_eq! in BytesToEntriesIter::new_from_header that expects version 2. The attack requires the victim to initiate the fetch from an attacker-controlled or compromised remote (UI:R), but no authentication is needed (PR:N); automated CI, dependency resolution, or mirror synchronization that pulls from untrusted sources is the primary exposure. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 score is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H per independent assessment).