{"id":"CVE-2026-38974","aliases":["AZL-92481","DEBIAN-CVE-2026-38974","EUVD-2026-44852","GHSA-h7fr-r783-5g99","SUSE-SU-2026:3408-1","SUSE-SU-2026:3459-1","UBUNTU-CVE-2026-38974"],"status":"published","title":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib...","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00325,"percentile":0.25863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-07-15T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["1.2.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-dulwich","fixed_in":["0.18.5-4.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3-dulwich","fixed_in":["0.20.24-150400.11.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.21.7-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.2-1","0.21.5-1","0.21.6-1","0.22.5-1","0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.11-1","1.2.12-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3","1.2.0-1","1.2.1-1","1.2.11-1","1.2.12-1","1.2.5-1","1.2.7-1","1.2.7-2"]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1"}]}],"versions":["0.22.7-1","0.22.7-2","0.24.10-1","0.24.2-1","0.24.2-2","1.0.0-1","1.0.0-2","1.1.0-1","1.1.0-2","1.1.0-3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-4.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python3-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.24-150400.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-1ubuntu1","0.12.0-1","0.12.0-1build1","0.12.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.2-1build1","0.18.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.11-2","0.19.14-4ubuntu1","0.19.15-1","0.19.15-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.15-1ubuntu1","0.20.31-1ubuntu1","0.20.31-1.1","0.20.31-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-1","0.21.6-1build1","0.21.6-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3","1.2.12-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.24.2-2","1.1.0-2ubuntu1","1.1.0-3"]}],"references":[{"url":"https://github.com/jelmer/dulwich/pull/2123","tags":["fix"]},{"url":"https://github.com/jelmer/dulwich","tags":["package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38974","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h7fr-r783-5g99"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38974.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-38974","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263408-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-38974","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263459-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-38974","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-38974","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-38974","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T18:26:43.162Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-44852","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T18:26:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:51.364603Z"}],"ghsa":[{"id":"GHSA-h7fr-r783-5g99","title":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib...","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-16T00:31:34Z","modified":"2026-07-16T21:31:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:09:34.599528Z"}],"nvd":[{"id":"CVE-2026-38974","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T22:16:47.443Z","modified":"2026-07-16T19:16:45.283Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-38974","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-10-28T02:30:50.517064211Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-38974","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T22:16:47.443Z","modified":"2026-10-01T03:03:22.500892644Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-38974","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T22:16:00Z","modified":"2026-10-17T13:00:02.894820276Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-92481","title":"CVE-2026-38974 affecting package python-dulwich 0.21.7-6","description":"Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.","status":"published","published":"2026-07-15T22:16:47Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"SUSE-SU-2026:3408-1","title":"Security update for python-dulwich","description":"This update for python-dulwich fixes the following issue\n\n- CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py (bsc#1271525).\n","status":"published","published":"2026-07-29T11:13:03Z","modified":"2026-07-30T17:15:10.485567611Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3459-1","title":"Security update for python3-dulwich","description":"This update for python3-dulwich fixes the following issue\n\n- CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py (bsc#1271525).\n","status":"published","published":"2026-08-03T12:08:36Z","modified":"2026-08-04T11:45:08.563258529Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}