CVE-2026-114095

MEDIUM 6.5

Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

CWE	CWE-835
Vendor	jelmer
Product	dulwich
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for jelmer dulwich

Be the first to know when new medium vulnerabilities affecting jelmer dulwich are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

jelmer / dulwich

0 < 1.2.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg vulncheck.com: https://www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-object

Credits

🔍 LukeBanto