All vulnerabilities
CVE-2026-114095GHSA-35mr-4567-66vg

Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

jelmer dulwichPyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.2.9Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.2.9dulwichCVE List
  • 1.2.9dulwich, PyPIOSVpip install "dulwich>=1.2.9"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

Text from CVE List

Affected versions 53

  • dulwichaffected: all versions before 1.2.9CVE List
  • dulwichunaffected: 1.2.9CVE List
  • dulwich, PyPIfrom first release, fixed in 1.2.9OSV
  • dulwich, PyPI0.0.1OSV
  • dulwich, PyPI0.1.0OSV
  • dulwich, PyPI0.1.1OSV
  • dulwich, PyPI0.10.0OSV
  • dulwich, PyPI0.10.1aOSV
  • dulwich, PyPI0.11.0OSV
  • dulwich, PyPI0.11.1OSV
  • dulwich, PyPI0.11.2OSV
  • dulwich, PyPI0.12.0OSV
  • dulwich, PyPI0.13.0OSV
  • dulwich, PyPI0.14.0OSV
  • dulwich, PyPI0.14.1OSV
  • dulwich, PyPI0.15.0OSV
  • dulwich, PyPI0.16.0OSV
  • dulwich, PyPI0.16.1OSV
  • dulwich, PyPI0.16.2OSV
  • dulwich, PyPI0.16.3OSV
  • dulwich, PyPI0.17.1OSV
  • dulwich, PyPI0.17.2OSV
  • dulwich, PyPI0.17.3OSV
  • dulwich, PyPI0.18.0OSV
  • dulwich, PyPI0.18.1OSV
  • dulwich, PyPI0.18.2OSV
  • dulwich, PyPI0.18.3OSV
  • dulwich, PyPI0.18.4OSV
  • dulwich, PyPI0.18.5OSV
  • dulwich, PyPI0.18.6OSV
  • dulwich, PyPI0.19.0OSV
  • dulwich, PyPI0.19.1OSV
  • dulwich, PyPI0.19.10OSV
  • dulwich, PyPI0.19.11OSV
  • dulwich, PyPI0.19.12OSV
  • dulwich, PyPI0.19.13OSV
  • dulwich, PyPI0.19.14OSV
  • dulwich, PyPI0.19.15OSV
  • dulwich, PyPI0.19.16OSV
  • dulwich, PyPI0.19.2OSV
  • dulwich, PyPI0.19.3OSV
  • dulwich, PyPI0.19.3a0OSV
  • dulwich, PyPI0.19.4OSV
  • dulwich, PyPI0.19.5OSV
  • dulwich, PyPI0.19.6OSV
  • dulwich, PyPI0.19.7OSV
  • dulwich, PyPI0.19.8OSV
  • dulwich, PyPI0.19.9OSV
  • dulwich, PyPI0.2.1OSV
  • dulwich, PyPI0.20.0OSV
  • dulwich, PyPI0.20.1OSV
  • dulwich, PyPI0.20.10OSV
  • dulwich, PyPI0.20.11OSV

References 2