gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills.

CVE-2026-82254 affects gitoxide versions before 0.69.0, a Rust-based Git implementation. The vulnerability involves two related flaws in the gix-pack component: unchecked array indexing during delta application and uncapped memory allocation driven by attacker-controlled size headers in pack data. Attackers can exploit these flaws by sending specially crafted pack data during Git clone or fetch operations. Successful exploitation can trigger Rust panics or out-of-memory process kills, resulting in a denial-of-service condition. No authentication appears to be required beyond initiating a clone or fetch from a malicious or compromised server. The fix is available in gitoxide version 0.69.0 and later. Users are advised to upgrade immediately to mitigate the risk.