Is CVE-2026-47734 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47734 being exploited in the wild.

How severe is CVE-2026-47734?

Medium severity, with a CVSS score of 5.7, published 10 June 2026.

Which products and versions are affected?

dulwich (PyPI) >= 0.1.0, < 1.2.5, ECOSYSTEM:introduced=0.1.0,fixed=1.2.5.

Is there a fix for CVE-2026-47734?

Yes. dulwich (PyPI): upgrade to 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47734 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47734?

Check whether you run dulwich (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47734: Dulwich uncontrolled memory allocation in git-receive-pack

Q: Is there a fix for CVE-2026-47734?

Yes. dulwich (PyPI): upgrade to 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47734 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-47734?

Check whether you run dulwich (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47734 · Severity: medium · CVSS 5.7 · Published 2026-06-10

Dulwich is a Python-based library used to implement Git server and client functionality. A vulnerability in how it handles incoming data allows an attacker with push access to crash the server by sending a specially crafted, very small file that triggers massive memory consumption. This can lead to a denial-of-service (DoS) condition, making the Git server unavailable to other users.

Technologies: dulwich (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-47734 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47734 being exploited in the wild.
How severe is CVE-2026-47734?: Medium severity, with a CVSS score of 5.7, published 10 June 2026.
Which products and versions are affected?: dulwich (PyPI) >= 0.1.0, < 1.2.5, ECOSYSTEM:introduced=0.1.0,fixed=1.2.5.
Is there a fix for CVE-2026-47734?: Yes. dulwich (PyPI): upgrade to 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47734 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47734?: Check whether you run dulwich (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dulwich (PyPI): upgrade to 1.2.5 or later
```
pip install "dulwich>=1.2.5"
```

Technical details

A memory exhaustion vulnerability (CWE-400/CWE-789) exists in Dulwich's 'add_thin_pack' and 'apply_delta' functions. An attacker with push privileges can submit a small (~174 bytes) crafted thin pack with a delta header declaring an extremely large 'dest_size'. The library attempts to allocate memory based on this attacker-controlled value rather than the actual data received, leading to hundreds of megabytes of allocation. This affects any Dulwich-based Git server exposing 'git-receive-pack', including the HTTP smart server. The issue is fixed in version 1.2.5 by implementing 'max_input_size' checks and honoring the 'receive.maxInputSize' configuration.

Affected products

Jelmer Vernooij Dulwich >= 0.1.0, < 1.2.5

Identifiers

CVE-2026-47734
GHSA-xrvj-v92f-53gj
PYSEC-2026-2466

Timeline

2026-05-28: patched: Version 1.2.5 released
2026-05-28: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE-2026-47734 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.