GCVE - cpe:2.3:a:dulwich_project:dulwich:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dulwich_project:dulwich:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Dulwich Project (`08302bd7-e1d7-5795-ab85-70cff6fadf7a`)
Product	Dulwich (`49bdb02f-0123-5c0f-bf6b-cf4b505c7eb8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/dulwich/dulwich`	purl2cpe	2026-06-01 10:15:32.800073

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-114097`	vulnerable	2026-11-03 10:15:53.753208	Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter HIGH (7.8) Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks. Published: 2026-10-21T00:37:00.461Z Updated: 2026-10-22T15:51:35.497Z Open on db.gcve.eu Reference links https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798 https://www.vulncheck.com/advisories/dulwich-0.23.1-before-1.2.8-symlink-path-traversal-via-filter-branch-index-filter	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-114096`	vulnerable	2026-11-03 10:15:53.652942	Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths HIGH (7.8) Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution. Published: 2026-10-21T00:36:59.763Z Updated: 2026-10-28T13:46:53.993Z Open on db.gcve.eu Reference links https://github.com/jelmer/dulwich/security/advisories/GHSA-8w8g-wq8h-fq33 https://www.vulncheck.com/advisories/dulwich-0.24.0-before-1.2.8-symlink-write-through-via-porcelain-checkout-paths	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-114094`	vulnerable	2026-11-03 10:15:53.262229	Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths HIGH (8.8) Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution. Published: 2026-10-21T00:36:58.401Z Updated: 2026-10-28T15:57:01.832Z Open on db.gcve.eu Reference links https://github.com/jelmer/dulwich/security/advisories/GHSA-8mcx-5rqc-vhmf https://www.vulncheck.com/advisories/dulwich-before-1.2.9-arbitrary-file-write-via-dos-drive-letter-paths	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-114098`	vulnerable	2026-11-03 10:15:53.251176	Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks HIGH (7.8) Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout. Published: 2026-10-21T00:37:01.150Z Updated: 2026-10-27T21:54:10.359Z Open on db.gcve.eu Reference links https://github.com/jelmer/dulwich/security/advisories/GHSA-cm62-gvxx-vmxx https://www.vulncheck.com/advisories/dulwich-0.22.5-before-1.2.8-path-traversal-via-stash-pop-symlinks	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-114095`	vulnerable	2026-11-03 10:15:52.702528	Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object MEDIUM (6.5) Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations. Published: 2026-10-21T00:36:59.083Z Updated: 2026-10-21T15:49:44.928Z Open on db.gcve.eu Reference links https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg https://www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-object	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16228`	vulnerable	2026-06-08 05:09:00.265148	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0838`	vulnerable	2026-06-08 05:06:24.007630	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9706`	vulnerable	2026-06-08 05:06:12.554693	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Dulwich

Notes

PURL mappings

Vulnerability references

Contribute