CVE-2026-114095: Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolveobject that allows attackers to cause infinite recursion via self-referential OFSDELTA objects. Attackers can supply a malicious packfile with an OFSDELTA deltaoffset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dulwichto a version that resolves this vulnerability.Fixed in 1.2.9
Event History
Frequently Asked Questions
Which operations can trigger the denial of service?
The issue can exhaust CPU during clone, fetch, or cat-file operations when they process a malicious packfile.
What does an attacker need to exploit this issue?
An attacker needs to supply a malicious packfile containing a self-referential OFS_DELTA object with a delta_offset of 0. No authentication is required, but user interaction is required according to the provided vector.
Which versions are affected?
Dulwich versions before 1.2.9 are affected. Updating to 1.2.9 or later addresses the affected version range.