267 matches found
CLSA-2026-1791266024 TuxCare security update for dulwich (4 CVEs)
TuxCare rebuilt dulwich to address 4 CVEs. Fixed in 0.25.2.post7+tuxcare...
CLSA-2026-1791190774 TuxCare security update for dulwich (1 CVE)
TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.21.7.post1+tuxcare...
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...
GHSA-8MCX-5RQC-VHMF Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via validatepath in dulwich/index.py when processing tree entries whose leading path component is a DOS drive-letter prefix e.g., C:. On Windows, os.path.joinroot, b"C:..." discards the work-tree root and resolves to...
GHSA-35MR-4567-66VG Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
Affected file dulwich/pack.py Method: Pack.resolveobject Description / Summary A High-severity Denial of Service DoS vulnerability exists in the Pack.resolveobject method. When resolving an OFSDELTA object, the resolver calculates the base offset using baseoffset = objoffset - deltaoffset. If a...
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
Affected file dulwich/pack.py Method: Pack.resolveobject Description / Summary A High-severity Denial of Service DoS vulnerability exists in the Pack.resolveobject method. When resolving an OFSDELTA object, the resolver calculates the base offset using baseoffset = objoffset - deltaoffset. If a...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop via unpackobject in dulwich/pack.py when parsing a pack file containing an OFSDELTA entry whose deltabaseoffset is zero. Such an entry references itself, causing Pack.resolveobject to loop forever, growing its delta stack...
GHSA-8W8G-WQ8H-FQ33 Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...
UNIX Symbolic Link (Symlink) Following
Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.openfilepath, OWRONLY|OCREAT|OTRUNC call that follows existing symlinks at the target path. An attacker...
GHSA-5FQC-MRG8-W798 Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack via applyindexfilter in dulwich/filterbranch.py, which called buildindexfromtree".", ... to materialize tree entries into the caller's working directory and left them there between commits. An attacker can craft a...
GHSA-CM62-GVXX-VMXX Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack via verifyleadingdirs absent in affected versions in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink...
CVE-2026-42563
A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the ProcessMergeDriver component incorrectly substitutes the...