A malformed thin‑pack can trigger a panic in Gitoxide’s gix‑pack component. The vulnerability is exposed when a malicious server sends a REF_DELTA referencing an existing object followed by an OFS_DELTA whose base_distance exceeds the pack_offset. The lookup routine panics, aborting the fetch operation and causing a denial of service.

Gitoxide Labs’ gix‑pack library in any version prior to 0.75.0 is affected. Applications that rely on gix‑pack for fetching Git objects, including forks or downstream projects that embed the library, must be examined for the same version range.

The CVSS score of 7.1 reflects a high severity denial of service. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, but the remote attack vector—any client fetching from a malicious remote—implies that an attacker can interrupt critical fetch operations. The lack of a mitigation in the vendor’s release notes means affected deployments remain susceptible until patched or replaced.