What’s Vulnerable › Vulnerabilities

CVE-2026-114095: Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-21
• Weakness: CWE-835

Description

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

Affected products

• Pypi Dulwich: before 1.2.9; 0.0.1, 0.1.0, 0.1.1, 0.10.0, 0.10.1a, 0.11.0 (+165) — fixed in 1.2.9
• jelmer dulwich: before 1.2.9 — fixed in 1.2.9

How to fix

Upgrade to a fixed version: Pypi Dulwich 1.2.9; jelmer dulwich 1.2.9. Check the vendor advisory for mitigations.

References

• https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg
• https://www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-object

Get alerted when CVE-2026-114095 or the next vulnerability affects your stack