CVE-2026-82254 affects gitoxide versions before 0.69.0, exposing a denial-of-service vulnerability in the gix-pack component. The flaw involves unchecked array indexing during delta application and uncapped memory allocation driven by attacker-controlled size headers. Attackers can exploit this by sending crafted pack data during clone or fetch operations. Successful exploitation can trigger panics or out-of-memory process kills, effectively disrupting service. The vulnerability is network-exploitable without authentication, requiring only that a victim performs a clone or fetch from a malicious or compromised repository. The fix is available in gitoxide 0.69.0 and above. Advisories have been published by GitoxideLabs and VulnCheck.
