Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47734— Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

Quick assessment

Affected
jelmer dulwich
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dulwich是Jelmer Vernooij个人开发者的一款纯Python实现的Git仓库操作接口。 Dulwich 1.2.5之前版本存在资源管理错误漏洞，该漏洞源于处理特制薄包时根据攻击者控制的dest_size分配内存，可能导致分配数百MB内存。

CVSS 5.7 · Medium EPSS 0.33% · P24

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
jelmer dulwich >= 0.1.0, < 1.2.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47734

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
Source: CVE Program / CVE List V5
Vulnerability Description
Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit, cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the host.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Dulwich 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dulwich是Jelmer Vernooij个人开发者的一款纯Python实现的Git仓库操作接口。 Dulwich 1.2.5之前版本存在资源管理错误漏洞，该漏洞源于处理特制薄包时根据攻击者控制的dest_size分配内存，可能导致分配数百MB内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
jelmer dulwich >= 0.1.0, < 1.2.5 -

II. Public POCs for CVE-2026-47734

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47734

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-47734 (1)

Vendor Pages for CVE-2026-47734 (1)

Same Patch Batch · jelmer · 2026-06-10 · 5 CVEs total

CVE-2026-42305 8.8 HIGH Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
CVE-2026-52726 7.5 HIGH Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse
CVE-2026-47712 3.3 LOW Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
CVE-2026-42563 Dulwich Vulnerable to Command Injection via Merge Driver Path

IV. Related Vulnerabilities

Same product: dulwich
Same vendor: jelmer
Same weakness: CWE-400

V. Comments for CVE-2026-47734

No comments yet

Leave a comment