CLSA-2026-1793014066 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.21.7.post2+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-114094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a...

Linux Distros Unpatched Vulnerability : CVE-2026-114096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by...

Linux Distros Unpatched Vulnerability : CVE-2026-114098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree...

Linux Distros Unpatched Vulnerability : CVE-2026-114097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter.applyindexfilter that allows attackers to write files outside the worki...

SUSE CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering...

CVE-2026-114098

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into restoring a stash in a specially crafted Git repository. During a stash pop operation, intermediate directory symbolic links symlinks are followed without adequate...

CVE-2026-114094

A flaw was found in Dulwich. On Windows systems, the application fails to validate drive letter prefixes within repository paths during checkout operations. A remote attacker could exploit this flaw by enticing a user to clone or check out a specially crafted Git repository containing malicious...

SUSE CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

SUSE CVE-2026-114096

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without ONOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...

SUSE CVE-2026-114097

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter.applyindexfilter that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a...

SUSE CVE-2026-114098

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into...

CVE-2026-114097

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into running branch filtering operations on a specially crafted Git repository. Because temporary files persist between commit processing cycles, symbolic links created in...

CVE-2026-114096

A flaw was found in Dulwich. When checking out specific file paths, the application improperly follows symbolic links when creating or restoring files. By tricking a user into checking out files from a maliciously crafted repository, an attacker can write arbitrary files to the local filesystem,...

Dulwich: Symlink Directory Traversal In Stash Pop Allows Arbitrary File Write Via Intermediate Directory Symlinks

Summary Dulwich's "stash.py:pop" function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The "pop" function at "dulwich/stash.py:236" uses...

Dulwich: Symlink Write-through In Checkout(paths=[]) Via Raw Os.open Bypasses All Symlink Protections

Summary Dulwich's "porcelain.checkoutpaths=..." code path writes files using raw "os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode" followed by "f.writeobj.data". This code path does NOT call "buildfilefromblob" at all, completely bypassing any symlink protections including the unreleased d09f8af fix...

Dulwich: Arbitrary File Write (RCE) On Windows Via Unvalidated Drive Letters In Tree Paths

Affected files "dulwich/index.py" Methods: "validatepathelementntfs", "treetofspath" "dulwich/porcelain/init.py" Method: "checkedworktreepath" Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible f...

Dulwich: Symlink Directory Traversal In Filter-branch Index_filter Via Cross-commit State Persistence

Summary Dulwich's "filterbranch.py" "CommitFilter.applyindexfilter" is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect...

Dulwich: Infinite Loop Denial Of Service (DoS) In Packfile Object Resolution

Affected file "dulwich/pack.py" Method: "Pack.resolveobject" Description / Summary A High-severity Denial of Service DoS vulnerability exists in the "Pack.resolveobject" method. When resolving an "OFSDELTA" object, the resolver calculates the base offset using "baseoffset = objoffset -...