CVE-2026-114095Medium· 6.5▾ SunlitDulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
0.3% → 0.3%
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
dulwich < 1.2.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
dulwich < 1.2.9Patched in:
dulwich 1.2.9Connected by shared product, vendor, weakness, or advisory.
GHSA-35mr-4567-66vgMedium· 6.5Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
CVE-2026-114094High· 8.8Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
GHSA-8mcx-5rqc-vhmfHigh· 8.8Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
CVE-2026-114096High· 7.8Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
CVE-2026-114097High· 7.8Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
CVE-2026-114098High· 7.8Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks