Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

dulwich

13 known vulnerabilities (8 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
1.2.21 (Nov 5, 2026): no advisory affects it
Newest unaffected release
1.2.21 (Nov 5, 2026), the latest release
Advisories
13 · 8 high, 1 medium, 1 low
Weekly downloads
12.9M
Dependents
717
Releases
159 since 0.9.1 (Sep 22, 2013)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

  • Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

    Affected: from 0.22.5, fixed in 1.2.8.

    Fixed in 1.2.8 (released Jul 5, 2026, 108 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

    Affected: from 0.23.1, fixed in 1.2.8.

    Fixed in 1.2.8 (released Jul 5, 2026, 108 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

    Affected: from 0.24.0, fixed in 1.2.8.

    Fixed in 1.2.8 (released Jul 5, 2026, 108 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

    Affected: fixed in 1.2.9.

    Fixed in 1.2.9 (released Jul 6, 2026, 107 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

    Affected: fixed in 1.2.9.

    Fixed in 1.2.9 (released Jul 6, 2026, 107 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via…

    Affected: from 0.23.2, fixed in 1.2.5.

    Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • CVE-2026-47734Medium 5.7

    Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

    Affected: from 0.1.0, fixed in 1.2.5.

    Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`

    Affected: from 0.24.0, fixed in 1.2.5.

    Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

    Affected: from 0.10.0, fixed in 1.2.5.

    Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich Vulnerable to Command Injection via Merge Driver Path

    Affected: from 0.24.0, fixed in 1.2.5.

    Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an…

    Affected: fixed in 0.18.5.

    Fixed in 0.18.5 (released Oct 29, 2017, the day of disclosure).

    The latest release, 1.2.21, is not affected.

  • Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute…

    Affected: fixed in 0.9.9.

    Fixed in 0.9.9 (released Mar 22, 2015, 9 days before disclosure).

    The latest release, 1.2.21, is not affected.

  • The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with…

    Affected: fixed in 0.9.9; fixed in 0.9.10.

    Fixed in 0.10.0 (released Mar 22, 2015, 9 days before disclosure, the advisory names 0.9.10, which was never published).

    The latest release, 1.2.21, is not affected.