Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 6.5, published 2 October 2026.
- Which products and versions are affected?
- Dulwich <UNKNOWN>; dulwich (PyPI) < 1.2.9.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Reject OFS_DELTA objects with delta_offset equal to zero, or implement a recursion depth limit (e.g., MAX_DELTA_DEPTH = 50) to prevent long delta chains from causing resource exhaustion.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run Dulwich or dulwich (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Reject OFS_DELTA objects with delta_offset equal to zero, or implement a recursion depth limit (e.g., MAX_DELTA_DEPTH = 50) to prevent long delta chains from causing resource exhaustion.</anigation> </invoke>
Technical details
The vulnerability exists in the `Pack.resolve_object` method when resolving OFS_DELTA objects. If delta_offset is zero, the calculation `base_offset = obj_offset - delta_offset` creates a self-referential offset that points back to the current object. Without depth tracking or validation, this causes infinite recursion. An attacker can craft a malicious packfile with a zero delta_offset to trigger this condition.
Affected products
- Dulwich Dulwich <UNKNOWN>
Timeline
- 2026-10-02: disclosed