| Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree PathsCVE-2026-114094 · GHSA-8MCX-5RQC-VHMF |
dulwich |
PyPI |
High
|
Fix reported |
|
| Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object ResolutionGHSA-35MR-4567-66VG |
dulwich |
PyPI |
Medium
|
Fix reported |
|
| Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protectionsGHSA-8W8G-WQ8H-FQ33 |
dulwich |
PyPI |
High
|
Fix reported |
|
| Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistenceGHSA-5FQC-MRG8-W798 |
dulwich |
PyPI |
High
|
Fix reported |
|
| Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinksGHSA-CM62-GVXX-VMXX |
dulwich |
PyPI |
High
|
Fix reported |
|
| Dulwich Vulnerable to Command Injection via Merge Driver PathCVE-2026-42563 · GHSA-9277-MP7X-85JFVersion ranges need review. |
dulwichRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/controller-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Dulwich has an arbitrary file write via NTFS-hostile tree entries on WindowsCVE-2026-42305 · GHSA-897W-FCG9-F6XJVersion ranges need review. |
dulwichRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/controller-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`CVE-2026-47712 · GHSA-555P-6GRF-MH7FVersion ranges need review. |
dulwichRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/controller-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Dulwich has unbounded memory allocation in receive-pack from crafted thin packsCVE-2026-47734 · GHSA-XRVJ-V92F-53GJVersion ranges need review. |
dulwichRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/controller-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payloadCVE-2026-52726 · GHSA-GFHV-VQV2-4544Version ranges need review. |
dulwichRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/controller-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Dulwich Arbitrary code execution via commit with directory path starting with .gitCVE-2014-9706 · GHSA-4J5J-58J7-6C3WVersion ranges need review. |
dulwich |
PyPI |
Critical
|
Fix reported |
|
| Dulwich RCE VulnerabilityCVE-2017-16228 · GHSA-CWWH-4382-6FWRVersion ranges need review. |
dulwichRed Hat OpenStack Platform 11 (Ocata)/python-dulwich |
PyPIRed Hat |
Critical
|
Fix reported |
|
| Dulwich Buffer Overflow when handling pack filesCVE-2015-0838 · GHSA-VJJF-3RVG-GV3VVersion ranges need review. |
dulwich |
PyPI |
Critical
|
Fix reported |
|
