What’s Vulnerable › Products

jelmer dulwich vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your jelmer dulwich version is affected

Latest jelmer dulwich vulnerabilities

• CVE-2026-114098 — Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks (CVSS 7.8)
• CVE-2026-114097 — Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter (CVSS 7.8)
• CVE-2026-114095 — Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object (CVSS 6.5)
• CVE-2026-114096 — Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths (CVSS 7.8)
• CVE-2026-114094 — Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths (CVSS 8.8)
• CVE-2026-52726 — Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload (CVSS 7.5)
• CVE-2026-47734 — Dulwich has unbounded memory allocation in receive-pack from crafted thin packs (CVSS 5.7)
• CVE-2026-47712 — Dulwich doesn't sanitize commit subjects in `porcelain.format_patch` (CVSS 3.3)
• CVE-2026-42563 — Dulwich Vulnerable to Command Injection via Merge Driver Path (CVSS 7.7)
• CVE-2026-42305 — Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows (CVSS 8.8)