Dulwich: Infinite Loop Denial Of Service (DoS) In Packfile Object Resolution

Affected file "dulwich/pack.py" Method: "Pack.resolveobject" Description / Summary A High-severity Denial of Service DoS vulnerability exists in the "Pack.resolveobject" method. When resolving an "OFSDELTA" object, the resolver calculates the base offset using "baseoffset = objoffset -...

DEBIAN-CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

EUVD-2026-106898

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-fil...

CVE-2026-114095

The Dulwich library (versions before 1.2.9 ) is vulnerable to a denial of service (DoS) via an infinite loop in the Pack.resolve_object function. An attacker can trigger infinite recursion by providing a malicious packfile containing self-referential OFS_DELTA objects with a delta_offset of 0. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-109350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack...

Linux Distros Unpatched Vulnerability : CVE-2026-114095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential...

SUSE CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

DEBIAN-CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

UBUNTU-CVE-2026-109350

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

EUVD-2026-97652

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109350

The gitoxide gix-pack component, in versions before 0.75.0 , is vulnerable to a Denial of Service (DoS) condition. The root cause lies in how the software handles crafted thin-pack OFS_DELTA entries during fetch operations. Specifically, if a remote server serves a thin pack where an OFS_DELTA 's...

CVE-2026-109350 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...

CVE-2026-109350 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance

Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFSDELTA entries. Attackers can serve a thin pack with a REFDELTA referencing an existing object followed by an OFSDELTA whose basedistan...