CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

CVE-2026-109350

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as .pack, .idx, or loose objects. An attacker can cause the application to panic by providing a payload that excee...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as .pack, .idx, or loose objects. An attacker can cause the application to panic by providing a payload that excee...

CVE-2025-54584 GitProxy is vulnerable to a packfile parsing exploit

GitProxy is an application that stands between developers and a Git remote endpoint e.g., github.com. In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within comm...