Jelmer Dulwich vulnerabilities

• jelmer dulwich Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation CVE-2026-122299 8.6 HighNovember 4, 2026
• jelmer dulwich Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths CVE-2026-114094 Fix available 8.7 HighOctober 2, 2026
• jelmer dulwich Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object CVE-2026-114095 Fix available 7.1 HighOctober 2, 2026
• jelmer dulwich Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths CVE-2026-114096 Fix available 7.3 HighOctober 2, 2026
• jelmer dulwich Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter CVE-2026-114097 Fix available 7.3 HighOctober 2, 2026
• jelmer dulwich Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks CVE-2026-114098 Fix available 7.3 HighOctober 2, 2026
• jelmer dulwich Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload CVE-2026-52726 Fix available 7.5 HighJune 10, 2026
• jelmer dulwich Dulwich has unbounded memory allocation in receive-pack from crafted thin packs CVE-2026-47734 Fix available 5.7 MediumJune 8, 2026
• jelmer dulwich Dulwich doesn't sanitize commit subjects in `porcelain.format_patch` CVE-2026-47712 Fix available 3.3 LowMay 29, 2026
• jelmer dulwich Dulwich Vulnerable to Command Injection via Merge Driver Path CVE-2026-42563 Fix available 7.7 HighMay 28, 2026
• jelmer dulwich Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows CVE-2026-42305 Fix available 8.8 HighMay 28, 2026