PT-2026-120221

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve object that allows attackers to cause infinite recursion via self-referential OFS DELTA objects. Attackers can supply a malicious packfile with an OFS DELTA delta offset of 0 to exhaust CPU during clone, fetch, or...

PT-2026-110767

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description A denial of service issue exists where malicious remotes can crash fetch operations by sending crafted thin-pack OFS DELTA entries. An attacker can provide a thin pack containing a REF DEL...

PT-2026-111182

Affected file dulwich/pack.py Method: Pack.resolve object Description / Summary A High-severity Denial of Service DoS vulnerability exists in the Pack.resolve object method. When resolving an OFS DELTA object, the resolver calculates the base offset using base offset = obj offset - delta offset. ...

PT-2026-84069

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git delta apply in src/libgit2/delta.c trusts the attacker-controlled res sz value parsed by hdr sz...