dulwich vulnerabilities (Root)

4 vulnerabilities.

• dulwich Root Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload CVE-2026-52726 Fix available 7.5 HighJune 10, 2026
• dulwich Root Dulwich has unbounded memory allocation in receive-pack from crafted thin packs CVE-2026-47734 Fix available 5.7 MediumJune 8, 2026
• dulwich Root Dulwich Vulnerable to Command Injection via Merge Driver Path CVE-2026-42563 Fix available 7.7 HighMay 28, 2026
• dulwich Root Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows CVE-2026-42305 Fix available 8.8 HighMay 28, 2026