Is CVE-2026-38974 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-38974 being exploited in the wild.

How severe is CVE-2026-38974?

Informational severity, published 15 July 2026.

Which products and versions are affected?

Jelmer Vernooij Dulwich <= 1.1.0.

Is there a fix for CVE-2026-38974?

A patch was published on 2026-03-25: Pull request 2123 merged to fix host key verification. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-38974 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-38974?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38974: Dulwich missing SSH host key verification in Paramiko vendor

Q: Is there a fix for CVE-2026-38974?

A patch was published on 2026-03-25: Pull request 2123 merged to fix host key verification. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-38974 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-38974?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-38974 · Severity: info · Published 2026-07-15

Dulwich, a Python-based implementation of the Git protocol, contains a security flaw in its SSH connection handling. The software fails to verify the identity of remote servers when using the Paramiko library, which could allow an attacker to intercept or modify data during Git operations. This puts sensitive source code and credentials at risk of being captured by an unauthorized party during network transfers.

Quick answers

Is CVE-2026-38974 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-38974 being exploited in the wild.
How severe is CVE-2026-38974?: Informational severity, published 15 July 2026.
Which products and versions are affected?: Jelmer Vernooij Dulwich <= 1.1.0.
Is there a fix for CVE-2026-38974?: A patch was published on 2026-03-25: Pull request 2123 merged to fix host key verification. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-38974 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-38974?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Dulwich's 'contrib/paramiko_vendor.py' where SSH host key verification is disabled or missing. By default, the implementation fails to load known hosts or reject unknown keys, which is a violation of secure SSH transport practices. An attacker positioned on the network between the client and the Git server could perform a Man-in-the-Middle (MitM) attack to intercept or alter Git traffic. The issue is addressed in versions following 1.1.0 by properly loading known hosts and enforcing key rejection by default.

Affected products

Jelmer Vernooij Dulwich <= 1.1.0

Timeline

2026-03-25: patched: Pull request 2123 merged to fix host key verification.
2026-07-15: disclosed: CVE-2026-38974 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.