---
id: CVE-2026-47734
title: 'dulwich: Dulwich: Denial of Service via crafted Git thin pack (CVE-2026-47734)'
summary: >-
  A flaw was found in Dulwich, a pure-Python implementation of Git file formats
  and protocols. A remote attacker with push access to a Dulwich-based Git
  server could send a specially crafted thin pack. This crafted pack, with a
  manipulated d…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-1285
  - CWE-400
  - CWE-789
vendor: Red Hat
product: Red Hat Enterprise Linux 7
affected:
  - ansible_automation_platform 2
  - enterprise_linux 7
  - enterprise_linux 8
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - satellite 6
patched:
  - dulwich 1.2.5
published: '2026-06-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T11:23:20+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47734.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47734.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-47734'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487774'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-47734'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47734'
  - url: 'https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5'
  - url: 'https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj'
  - url: 'https://github.com/advisories/GHSA-xrvj-v92f-53gj'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - pip
epss: 0.00188
epssPercentile: 0.08344
aliases:
  - GHSA-xrvj-v92f-53gj
ecosystem: pip
scores:
  vendor: 6.5
  ghsa: 5.7
ingestedAt: '2026-07-07T15:41:59.614Z'
---

## Overview

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. A remote attacker with push access to a Dulwich-based Git server could send a specially crafted thin pack. This crafted pack, with a manipulated delta header, would cause the server to allocate excessive amounts of memory, leading to a Denial of Service (DoS) condition. This vulnerability allows an authenticated attacker to disrupt the availability of the Git server.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat Satellite 6 · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift AI (RHOAI), … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47734.json)

**dulwich: Dulwich: Denial of Service via crafted Git thin pack** — rated Moderate by Red Hat. Released 2026-06-10, updated 2026-10-16.

Affected:

- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6

No fix planned:

- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Satellite 6

## Remediation

Fix deferred

Workarounds / mitigations:

- This flaw is fixed in Dulwich 1.2.5, which adds a max_input_size limit to add_thin_pack and makes ReceivePackHandler honor the receive.maxInputSize repository configuration setting (equivalent to git index-pack --max-input-size). Upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in the Git server's repository configuration to a sensible bound for the environment. On unpatched versions, receive.maxInputSize has no effect and cannot be used as a workaround. Until the fixed version is…

## Package advisory (CVE-2026-47734)

Affected packages:

- `dulwich >= 0.1.0, < 1.2.5`

Patched in:

- `dulwich 1.2.5`

Source: https://github.com/advisories/GHSA-xrvj-v92f-53gj