CVE-2026-38974

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib...

5.3 MediumFix available

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.33%Up 0.2 points since Jul 16, 2026

What each source reports

CVE List Score used 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: CVE-2026-38974
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

EUVDEUVD-2026-44852 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: EUVD-2026-44852
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h7fr-r783-5g99 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib...

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: GHSA-h7fr-r783-5g99
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

NVD 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: CVE-2026-38974
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-295
Updated: 2026-11-02

OSV 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: CVE-2026-38974
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-38974 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: DEBIAN-CVE-2026-38974
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2026-38974 5.3

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: UBUNTU-CVE-2026-38974
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVAZL-92481 No score

CVE-2026-38974 affecting package python-dulwich 0.21.7-6

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Record: AZL-92481
Updated: 2026-11-05

OSVSUSE-SU-2026:3408-1 No score

Security update for python-dulwich

This update for python-dulwich fixes the following issue

CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py (bsc#1271525).

Record: SUSE-SU-2026:3408-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3459-1 No score

Security update for python3-dulwich

This update for python3-dulwich fixes the following issue

CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py (bsc#1271525).

Record: SUSE-SU-2026:3459-1
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`python-dulwich` Azure Linux:3	through 0.21.7-6	None known
`dulwich` Debian:12	All versions, plus listed versions 0.21.2-10.21.5-10.21.6-10.22.5-10.22.7-1 Show 16 moreShow less 0.22.7-20.24.10-10.24.2-10.24.2-21.0.0-11.0.0-21.1.0-11.1.0-21.1.0-31.2.0-11.2.1-11.2.11-11.2.12-11.2.5-11.2.7-11.2.7-2	None known
`dulwich` Debian:13	All versions, plus listed versions 0.22.7-10.22.7-20.24.10-10.24.2-10.24.2-2 Show 12 moreShow less 1.0.0-11.0.0-21.1.0-11.1.0-21.1.0-31.2.0-11.2.1-11.2.11-11.2.12-11.2.5-11.2.7-11.2.7-2	None known
`dulwich` Debian:14	before 1.2.0-1, plus listed versions 0.22.7-10.22.7-20.24.10-10.24.2-10.24.2-2 Show 5 moreShow less 1.0.0-11.0.0-21.1.0-11.1.0-21.1.0-3	1.2.0-1
`python-dulwich` SUSE:Linux Enterprise Module for Public Cloud 12	before 0.18.5-4.9.1	0.18.5-4.9.1
`python3-dulwich` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 0.20.24-150400.11.1	0.20.24-150400.11.1

Show 13 moreShow less

Affected packages
Package	Affected	Fixed
`python3-dulwich` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`python3-dulwich` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 0.20.24-150400.11.1	0.20.24-150400.11.1
`dulwich` Ubuntu:16.04:LTS	All versions, plus listed versions 0.11.2-1ubuntu10.12.0-10.12.0-1build10.12.0-1build2	None known
`dulwich` Ubuntu:18.04:LTS	All versions, plus listed versions 0.18.2-1build10.18.5-1	None known
`dulwich` Ubuntu:20.04:LTS	All versions, plus listed versions 0.19.11-20.19.14-4ubuntu10.19.15-10.19.15-1build1	None known
`dulwich` Ubuntu:22.04:LTS	All versions, plus listed versions 0.20.15-1ubuntu10.20.31-1ubuntu10.20.31-1.10.20.31-1.1build1	None known
`dulwich` Ubuntu:24.04:LTS	All versions, plus listed versions 0.21.6-10.21.6-1build10.21.6-1build2	None known
`dulwich` Ubuntu:26.10	All versions, plus listed versions 1.1.0-31.2.12-1	None known
`dulwich` Ubuntu:26.04:LTS	All versions, plus listed versions 0.22.7-10.24.2-21.1.0-2ubuntu11.1.0-3	None known

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-38974 is a medium vulnerability (CVSS 5.3) in dulwich, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in dulwich 1.2.0-1.

References

Show 6 moreShow less