Executive brief
Dulwich is a Python-based library used to implement Git server and client functionality. A vulnerability in how it handles incoming data allows an attacker with push access to crash the server by sending a specially crafted, very small file that triggers massive memory consumption. This can lead to a denial-of-service (DoS) condition, making the Git server unavailable to other users.
Technical details
A memory exhaustion vulnerability (CWE-400/CWE-789) exists in Dulwich's 'add_thin_pack' and 'apply_delta' functions. An attacker with push privileges can submit a small (~174 bytes) crafted thin pack with a delta header declaring an extremely large 'dest_size'. The library attempts to allocate memory based on this attacker-controlled value rather than the actual data received, leading to hundreds of megabytes of allocation. This affects any Dulwich-based Git server exposing 'git-receive-pack', including the HTTP smart server. The issue is fixed in version 1.2.5 by implementing 'max_input_size' checks and honoring the 'receive.maxInputSize' configuration.
Affected products
- Jelmer Vernooij Dulwich >= 0.1.0, < 1.2.5
Timeline
- 2026-05-28: patched: Version 1.2.5 released
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE-2026-47734 published to NVD