---
id: CVE-2026-122299
title: Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation
summary: >-
  Dulwich before 1.2.20 contains a commit object parsing vulnerability where the
  read path in _parse_commit resolves a duplicate tree header to the last
  occurrence instead of the first, diverging from core git's resolution
  behavior, while …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1250
  - CWE-115
vendor: jelmer
product: dulwich
affected:
  - dulwich < 1.2.20
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:57:13.686Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122299'
references:
  - url: 'https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.20'
    label: Vendor Patch
  - url: >-
      https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96
  - url: >-
      https://www.vulncheck.com/advisories/dulwich-before-commit-parser-tree-header-misinterpretation
    label: >-
      VulnCheck Advisory: Dulwich before 1.2.20 Commit Parser Tree Header
      Misinterpretation
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.666Z'
epss: 0.00325
epssPercentile: 0.25742
---

## Overview

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default for git dependency installation. Attackers can craft a commit object with two tree headers so that reviewers and CI using git see a benign tree while Poetry's dulwich-based checkout resolves to a different attacker-controlled tree containing malicious build scripts such as setup.py, resulting in unreviewed code execution on the install or build host.

## Affected

- `dulwich < 1.2.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.