MGASA-2026-0589 Updated python-dulwich & rust-similar3 packages fixes security vulnerabilities

Commit subjects not sanitized in porcelain.formatpatch Unbounded memory allocation in receive-pack from crafted thin packs Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree through...

Updated python-dulwich & rust-similar3 packages fixes security vulnerabilities

Commit subjects not sanitized in porcelain.formatpatch Unbounded memory allocation in receive-pack from crafted thin packs Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree through...

CVE-2026-122299

A flaw was found in Dulwich. This flaw allows arbitrary code execution on systems that process untrusted repositories. When parsing Git commit objects, Dulwich resolves duplicate tree headers to the last occurrence instead of the first, conflicting with standard Git behavior. A remote attacker ca...

CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

EUVD-2026-117194

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

Improper Preservation of Consistency Between Independent Representations of Shared State

Overview Affected versions of this package are vulnerable to Improper Preservation of Consistency Between Independent Representations of Shared State via parsecommit in dulwich/objects.py, which resolves a duplicate tree header in a commit object to the last occurrence rather than the first,...

Linux Distros Unpatched Vulnerability : CVE-2026-122299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence...

DEBIAN-CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299 Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299 Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-122299

The Dulwich library (versions before 1.2.20 ) contains a commit object parsing vulnerability in the _parse_commit read path. The flaw allows the parser to resolve duplicate tree headers to the last occurrence instead of the first, which deviates from standard core git behavior. This inconsistency...

PT-2026-137230

Name of the Vulnerable Software and Affected Versions Dulwich versions prior to 1.2.20 Poetry version 2.5.1 Description A commit object parsing issue exists where the read path in the parse commit function resolves a duplicate tree header to the last occurrence instead of the first. This behavior...

CLSA-2026-1793014066 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.21.7.post2+tuxcare...

Linux Distros Unpatched Vulnerability : CVE-2026-114098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree...

Linux Distros Unpatched Vulnerability : CVE-2026-114096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by...

Linux Distros Unpatched Vulnerability : CVE-2026-114094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a...

Linux Distros Unpatched Vulnerability : CVE-2026-114097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter.applyindexfilter that allows attackers to write files outside the worki...

SUSE CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering...