jelmer/dulwich Security Advisories | GitStock

high2026-10-02

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

GHSA-8mcx-5rqc-vhmf

medium2026-10-02

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

GHSA-35mr-4567-66vg

high2026-10-02

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

GHSA-8w8g-wq8h-fq33

high2026-10-02

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

GHSA-5fqc-mrg8-w798

high2026-10-02

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

GHSA-cm62-gvxx-vmxx

high2026-07-02

Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload

GHSA-gfhv-vqv2-4544 · CVE-2026-52726

medium2026-06-08

Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

GHSA-xrvj-v92f-53gj · CVE-2026-47734

low2026-06-08

Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

GHSA-555p-6grf-mh7f · CVE-2026-47712

high2026-05-28

Dulwich Vulnerable to Command Injection via Merge Driver Path

GHSA-9277-mp7x-85jf · CVE-2026-42563

high2026-05-28

Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

GHSA-897w-fcg9-f6xj · CVE-2026-42305

critical2022-05-17

Dulwich Buffer Overflow when handling pack files

GHSA-vjjf-3rvg-gv3v · CVE-2015-0838

critical2022-05-17

Dulwich Arbitrary code execution via commit with directory path starting with .git

GHSA-4j5j-58j7-6c3w · CVE-2014-9706

critical2022-05-13

Dulwich RCE Vulnerability

GHSA-cwwh-4382-6fwr · CVE-2017-16228