A reachable assertion in the pack header decoder of gix-pack causes a panic when a malicious client sends a version 3 header. The offending code performs an 'assert_eq!' that expects version 2, so the mismatch triggers an abort during the clone or fetch operation, halting the process and denying service to the affected client. This DoS flaw is specific to the assertion logic and does not expose data or allow arbitrary code execution. The weakness corresponds to CWE‑617, which involves reaching an assertion condition that leads to a program crash.

All releases of GitoxideLabs gix-pack prior to version 0.75.0 are affected. The vulnerability exists in any environment where a client uses a pre‑0.75.0 gix-pack binary to process inbound pack files, such as Git clone or fetch operations over HTTP or the Git protocol. No specific operating system or platform constraints are noted, and the flaw is triggered purely by the content of the incoming pack data.

The CVSS score of 7.1 indicates a high risk, and the EPSS score is not available, meaning we do not have a quantified exploitation probability but the lack of availability does not diminish potential impact. Because the assertion is reachable via a network connection, an attacker can trigger the panic remotely by transmitting a crafted 12‑byte pack header declaring version 3. The attack requires no authentication; any party able to interact with the Git service can exploit. The vulnerability is not listed in the CISA KEV catalog, but its nature (remote trigger) makes a Denial‑of‑Service attack straightforward if the affected library is in use. The potential service disruption could affect any Git host or client using gix-pack, leading to aborted operations and degraded availability for all users of that system.