AIKIDO-2026-122106

TL;DR

gix-packetline decodes side-band packet lines while a client reads data from a Git remote during fetch or clone. When a side-band line carries only the band-id byte and an empty payload, the trailing-newline handling indexes the payload slice without a length check, causing an unsigned integer underflow and an out-of-bounds access. A malicious or attacker-influenced remote can send such a packet to trigger a panic that aborts the client process, resulting in a pre-authentication, network-triggered denial of service. The fix adds bounds checks so empty side-band payloads are handled as protocol errors instead of panicking.