Gitoxide gix-pack before version 0.75.0 contains an uncontrolled memory allocation flaw that lets a remote attacker supply an enormous pack-header object count. A malicious remote repository can advertise 0xFFFFFFFF objects, causing the library to reserve hundreds of gigabytes and crash during clone or fetch, resulting in a denial‑of‑service for the affected client process.

The vulnerability affects GitoxideLabs gix-pack implementations prior to 0.75.0. Any instance of the library linked into a Git client or other tooling that uses pack operations is potentially exposed if it imports the vulnerable version.

The CVSS score of 7.1 indicates a high severity risk. The flaw is exploitable over the network by any attacker who can supply a malicious pack header to a clone or fetch operation; therefore, the attack vector is remote and likely automatic. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high impact and easy exploitability recommend urgent action.