dulwich: Dulwich: Denial of Service via crafted Git thin pack (CVE-2026-47734)

Overview

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. A remote attacker with push access to a Dulwich-based Git server could send a specially crafted thin pack. This crafted pack, with a manipulated delta header, would cause the server to allocate excessive amounts of memory, leading to a Denial of Service (DoS) condition. This vulnerability allows an authenticated attacker to disrupt the availability of the Git server.

Vendor advisories

• Red Hat VEX · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), … · updated 2026-10-16 · vex

dulwich: Dulwich: Denial of Service via crafted Git thin pack — rated Moderate by Red Hat. Released 2026-06-10, updated 2026-10-16.

Affected:

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat OpenShift AI (RHOAI)
• Red Hat OpenShift Container Platform 4
• Red Hat Satellite 6

No fix planned:

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat OpenShift AI (RHOAI)
• Red Hat OpenShift Container Platform 4
• Red Hat Satellite 6

Remediation

Fix deferred

Workarounds / mitigations:

• This flaw is fixed in Dulwich 1.2.5, which adds a max_input_size limit to add_thin_pack and makes ReceivePackHandler honor the receive.maxInputSize repository configuration setting (equivalent to git index-pack --max-input-size). Upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in the Git server's repository configuration to a sensible bound for the environment. On unpatched versions, receive.maxInputSize has no effect and cannot be used as a workaround. Until the fixed version is…

Package advisory (CVE-2026-47734)

Affected packages:

• dulwich >= 0.1.0, < 1.2.5

Patched in:

• dulwich 1.2.5

Source: https://github.com/advisories/GHSA-xrvj-v92f-53gj