GHSA-8MCX-5RQC-VHMF Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...

GHSA-35MR-4567-66VG Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

Affected file dulwich/pack.py Method: Pack.resolveobject Description / Summary A High-severity Denial of Service DoS vulnerability exists in the Pack.resolveobject method. When resolving an OFSDELTA object, the resolver calculates the base offset using baseoffset = objoffset - deltaoffset. If a...

GHSA-5FQC-MRG8-W798 Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

CVE-2026-42563

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the ProcessMergeDriver component incorrectly substitutes the...

ROOT-APP-PYPI-CVE-2026-47734 CVE-2026-47734 in dulwich - Patched by Root

Root has patched CVE-2026-47734 in the dulwich package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-42563 CVE-2026-42563 in dulwich - Patched by Root

Root has patched CVE-2026-42563 in the dulwich package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-42305 CVE-2026-42305 in dulwich - Patched by Root

Root has patched CVE-2026-42305 in the dulwich package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-52726 CVE-2026-52726 in dulwich - Patched by Root

Root has patched CVE-2026-52726 in the dulwich package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1784164011 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.25.2.post6+tuxcare...

CLSA-2026-1783299701 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.25.2.post5+tuxcare...

CLSA-2026-1781484847 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.25.2.post4+tuxcare...

CLSA-2026-1781225617 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.25.2.post3+tuxcare...

CLSA-2026-1781052734 TuxCare security update for dulwich (1 CVE)

TuxCare rebuilt dulwich to address 1 CVE. Fixed in 0.25.2.post2+tuxcare...

SUSE SLED15 / SLES15 Security Update : python3-dulwich (SUSE-SU-2026:3459-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3459-1 advisory. This update for python3-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missi...

Important: python-dulwich

Issue Overview: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py. CVE-2026-38974 Arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted...

Amazon Linux 2023 : python3-dulwich (ALAS2023-2026-2026)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2026 advisory. Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py. CVE-2026-38974 Arbitrary file write leading to remote code execution when cloning or...

Security update for python3-dulwich

This update for python3-dulwich fixes the following issue CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py bsc1271525. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3459-1 Security update for python3-dulwich

This update for python3-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py bsc1271525...

The vulnerability of the Python library for working with Git repositories in Dulwich, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the Python library for working with Git repositories in Dulwich is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

SUSE SLES12 Security Update : python-dulwich (SUSE-SU-2026:3408-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3408-1 advisory. This update for python-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key...