CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering...

PT-2026-120221

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve object that allows attackers to cause infinite recursion via self-referential OFS DELTA objects. Attackers can supply a malicious packfile with an OFS DELTA delta offset of 0 to exhaust CPU during clone, fetch, or...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

gix-pack: gix-pack: Denial of Service via malformed packfile delta entries

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

CVE-2026-109350

A flaw was found in gix-pack. A malicious remote repository can cause a Denial of Service DoS by serving a crafted Git packfile containing malformed delta offset entries during a fetch operation. Processing these entries leads to an unhandled application crash, abruptly terminating the fetch...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as .pack, .idx, or loose objects. An attacker can cause the application to panic by providing a payload that excee...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as .pack, .idx, or loose objects. An attacker can cause the application to panic by providing a payload that excee...

go-git improperly verifies data integrity values for .idx and .pack files

Impact A vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch...

EUVD-2025-23193

Malicious code in bioql PyPI...

Misinterpretation of Input

Overview @finos/git-proxy is a Deploy custom push protections and policies on top of Git. Affected versions of this package are vulnerable to Misinterpretation of Input via the parsePush.ts file. An attacker can bypass approval mechanisms or hide commits by crafting a malicious Git packfile that...

CVE-2025-54584

GitProxy is an application that stands between developers and a Git remote endpoint e.g., github.com. In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within comm...

CVE-2025-54584 GitProxy is vulnerable to a packfile parsing exploit

GitProxy is an application that stands between developers and a Git remote endpoint e.g., github.com. In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within comm...

CVE-2025-54584 GitProxy is vulnerable to a packfile parsing exploit

GitProxy is an application that stands between developers and a Git remote endpoint e.g., github.com. In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within comm...

CVE-2025-54584

GitProxy (versions ≤ 1.19.1) is vulnerable to a packfile parsing exploit due to the parsePush.ts PACK signature detection. An attacker can craft a malicious Git packfile that embeds a misleading PACK signature within commit content and manipulates the packet structure, causing the parser to treat...

CVE-2025-54584 GitProxy is vulnerable to a packfile parsing exploit

GitProxy is an application that stands between developers and a Git remote endpoint e.g., github.com. In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within comm...

GitProxy Backfile Parsing Exploit

Summary An attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended...

GHSA-XXMH-RF63-QWJV GitProxy Backfile Parsing Exploit

Summary An attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended...

FreeBSD : Libgit2 -- multiple vulnerabilities (3c9b7698-84da-11e8-8c75-d8cb8abf62dd)

The Git community reports : Out-of-bounds reads when reading objects from a packfile C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use...

Libgit2 -- multiple vulnerabilities

The Git community reports: Out-of-bounds reads when reading objects from a packfile...

Netwrix Auditor 7.1.322.0 - ActiveX 'sourceFile' Stack Buffer Overflow

Netwrix Auditor 7.1.322.0 ActiveX sourceFile Stack Buffer Overflow Vulnerability Vendor: Netwrix Corporation Product web page: http://www.netwrix.com Affected version: 7.1 Build 322 Summary: Netwrix Auditor is an IT audit software that maximizes visibility of IT infrastructure changes and data...