# dulwich (PyPI) vulnerabilities 13 known vulnerabilities (8 high, 1 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.2.21 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 1.2.21 (Nov 5, 2026), the latest release - Weekly downloads: 12.9M - Dependents: 717 - Releases: 159 since 0.9.1 (Sep 22, 2013) - Registry: https://pypi.org/project/dulwich/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114098: 0.22.5 to 1.2.7 (1.2.8 is outside it) - CVE-2026-114097: 0.23.1 to 1.2.7 (1.2.8 is outside it) - CVE-2026-114096: 0.24.0 to 1.2.7 (1.2.8 is outside it) - CVE-2026-114095: 0.9.1 to 1.2.8 (1.2.9 is outside it) - CVE-2026-114094: 0.9.1 to 1.2.8 (1.2.9 is outside it) - CVE-2026-52726: 0.23.2 to 1.2.4 (1.2.5 is outside it) - CVE-2026-47734: 0.9.1 to 1.2.4 (1.2.5 is outside it) - CVE-2026-47712: 0.24.0 to 1.2.4 (1.2.5 is outside it) - CVE-2026-42305: 0.10.0 to 1.2.4 (1.2.5 is outside it) - CVE-2026-42563: 0.24.0 to 1.2.4 (1.2.5 is outside it) - CVE-2017-16228: 0.9.1 to 0.18.4 (0.18.5 is outside it) - CVE-2015-0838: 0.9.1 to 0.9.8 (0.9.9 is outside it) - CVE-2014-9706: 0.9.1 to 0.9.9 (0.10.0 is outside it) ## Advisories (13) ### [CVE-2026-114098](https://cve.now/CVE-2026-114098): Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks - Severity: High 7.3 - Published: Oct 21, 2026 - Affected: from 0.22.5, fixed in 1.2.8. - Fixed in 1.2.8 (released Jul 5, 2026, 108 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-114097](https://cve.now/CVE-2026-114097): Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter\_branch Index Filter - Severity: High 7.3 - Published: Oct 21, 2026 - Affected: from 0.23.1, fixed in 1.2.8. - Fixed in 1.2.8 (released Jul 5, 2026, 108 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-114096](https://cve.now/CVE-2026-114096): Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths - Severity: High 7.3 - Published: Oct 21, 2026 - Affected: from 0.24.0, fixed in 1.2.8. - Fixed in 1.2.8 (released Jul 5, 2026, 108 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-114095](https://cve.now/CVE-2026-114095): Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve\_object - Severity: High 7.1 - Published: Oct 21, 2026 - Affected: fixed in 1.2.9. - Fixed in 1.2.9 (released Jul 6, 2026, 107 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-114094](https://cve.now/CVE-2026-114094): Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths - Severity: High 8.7 - Published: Oct 21, 2026 - Affected: fixed in 1.2.9. - Fixed in 1.2.9 (released Jul 6, 2026, 107 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-52726](https://cve.now/CVE-2026-52726): Dulwich's submodule path traversal in porcelain.submodule\_update / porcelain.clone(recurse\_submodules=True) yields RCE via… - Severity: High 7.5 - Published: Jun 10, 2026 - Affected: from 0.23.2, fixed in 1.2.5. - Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-47734](https://cve.now/CVE-2026-47734): Dulwich has unbounded memory allocation in receive-pack from crafted thin packs - Severity: Medium 5.7 - Published: Jun 10, 2026 - Affected: from 0.1.0, fixed in 1.2.5. - Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-47712](https://cve.now/CVE-2026-47712): Dulwich doesn't sanitize commit subjects in \`porcelain.format\_patch\` - Severity: Low 3.3 - Published: Jun 10, 2026 - Affected: from 0.24.0, fixed in 1.2.5. - Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-42305](https://cve.now/CVE-2026-42305): Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows - Severity: High 8.8 - Published: Jun 10, 2026 - Affected: from 0.10.0, fixed in 1.2.5. - Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2026-42563](https://cve.now/CVE-2026-42563): Dulwich Vulnerable to Command Injection via Merge Driver Path - Severity: High 7.7 - Published: Jun 10, 2026 - Affected: from 0.24.0, fixed in 1.2.5. - Fixed in 1.2.5 (released May 28, 2026, 13 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2017-16228](https://cve.now/CVE-2017-16228): Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an… - Severity: Unrated - Published: Oct 29, 2017 - Affected: fixed in 0.18.5. - Fixed in 0.18.5 (released Oct 29, 2017, the day of disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2015-0838](https://cve.now/CVE-2015-0838): Buffer overflow in the C implementation of the apply\_delta function in \_pack.c in Dulwich before 0.9.9 allows remote attackers to execute… - Severity: Unrated - Published: Mar 31, 2015 - Affected: fixed in 0.9.9. - Fixed in 0.9.9 (released Mar 22, 2015, 9 days before disclosure). - The latest release, 1.2.21, is not affected. ### [CVE-2014-9706](https://cve.now/CVE-2014-9706): The build\_index\_from\_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with… - Severity: Unrated - Published: Mar 31, 2015 - Affected: fixed in 0.9.9; fixed in 0.9.10. - Fixed in 0.10.0 (released Mar 22, 2015, 9 days before disclosure, the advisory names 0.9.10, which was never published). - The latest release, 1.2.21, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/dulwich Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.