Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-82250: gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | cargo | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | clippy | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-analyzer | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-debugger-common | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-doc | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-gdb | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-src | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-std-static | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-toolset | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rust-toolset-srpm-macros | 0:1.98.0-1.amzn2 |
| Amazon Linux · 2 | rustfmt | 0:1.98.0-1.amzn2 |
Vulnerabilities 1
-
Medium 6.5
gitoxide gix-packetline before 0.21.5 Denial of Service
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index o…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-82250.html