DU
Product
dulwich
10
CVEs
0
On KEV
8.8
Max CVSS
5
New 30D
Severity mix
Critical 0High 7Medium 2Low 1
Watch
Add dulwich to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114094 | 8.8 | Oct 21 | Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths Affected: before 1.2.9 |
| CVE-2026-42305 | 8.8 | Jun 10 | Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows Affected: >= 0.10.0, < 1.2.5 |
| CVE-2026-114098 | 7.8 | Oct 21 | Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks Affected: 0.22.5 before 1.2.8 |
| CVE-2026-114097 | 7.8 | Oct 21 | Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter Affected: 0.23.1 before 1.2.8 |
| CVE-2026-114096 | 7.8 | Oct 21 | Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths Affected: 0.24.0 before 1.2.8 |
| CVE-2026-42563 | 7.7 | Jun 10 | Dulwich Vulnerable to Command Injection via Merge Driver Path Affected: >= 0.24.0, < 1.2.5 |
| CVE-2026-52726 | 7.5 | Jun 10 | Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload Affected: >= 0.23.2, < 1.2.5 |
| CVE-2026-114095 | 6.5 | Oct 21 | Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object Affected: before 1.2.9 |
| CVE-2026-47734 | 5.7 | Jun 10 | Dulwich has unbounded memory allocation in receive-pack from crafted thin packs Affected: >= 0.1.0, < 1.2.5 |
| CVE-2026-47712 | 3.3 | Jun 10 | Dulwich doesn't sanitize commit subjects in `porcelain.format_patch` Affected: >= 0.24.0, < 1.2.5 |
Showing 10