CVE-2026-82250 gitoxide gix-packetline before 0.21.5 Denial of Service
A malicious Git server can cause a client crash via crafted side-band packets in the gix-packetline library, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-82250?
CVE-2026-82250 is a high-severity denial of service vulnerability in GitoxideLabs gitoxide, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.
Weakness: CWE-191
Which versions are affected by CVE-2026-82250?
2 open source packages ship an affected version, including gix-packetline.
| Package | Affected | Fixed in |
|---|---|---|
gix-packetline crates.io | All versions | 0.21.5 |
gix-packetline crates.io | All versions | 0.21.5 |
How do I fix CVE-2026-82250?
Upgrade gix-packetline to 0.21.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-82250 being exploited?
There is no known exploitation of CVE-2026-82250 in the wild and no public exploit code.
Sources
Also known as AZL-98418, AZL-98430, DEBIAN-CVE-2026-82250, GHSA-2vh6-hw4j-32ww, GHSA-69hq-g659-8g9f, MINI-885f-wm4r-jvr6 and 1 more.