CVE-2026-82254: Uncaught Exception in GitoxideLabs gitoxide

CVE-2026-82254 describes a high-severity vulnerability in GitoxideLabs' gitoxide prior to version 0.69.0. The flaw arises from unchecked array indexing in delta application and uncapped memory allocation based on attacker-controlled size headers in the gix-pack processing. An attacker can exploit this by sending specially crafted pack data during git clone or fetch operations, causing the application to panic or be terminated due to out-of-memory conditions.

Successful exploitation can cause denial of service by crashing the gitoxide process or exhausting system memory, disrupting normal git operations such as clone and fetch. There is no indication of privilege escalation or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 0.69.0, upgrading to version 0.69.0 or later is likely the intended remediation once available. Until then, cautious handling of untrusted pack data is advised.