CVE-2026-114095: falha de alta gravidade em jelmer dulwich
Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
jelmer · dulwichCVEs relacionadas — jelmer dulwich
No mesmo produto, das mais perigosas para as menos.
CVE-2026-114094HIGHDulwich before 1.2.9 Arbitrary File Write via DOS drive letter pathsEPSS 0.9%CVE-2026-42305HIGHDulwich has an arbitrary file write via NTFS-hostile tree entries on WindowsEPSS 0.6%CVE-2026-42563HIGHDulwich Vulnerable to Command Injection via Merge Driver PathEPSS 0.6%CVE-2026-52726HIGHDulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payloadEPSS 0.4%CVE-2026-122299HIGHDulwich before 1.2.20 Commit Parser Tree Header MisinterpretationEPSS 0.3%CVE-2026-47734MEDIUMDulwich has unbounded memory allocation in receive-pack from crafted thin packsEPSS 0.2%