High
ghsa-8mcx-5rqc-vhmf
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 13
Reset filters
Medium
ghsa-35mr-4567-66vg
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
High
ghsa-8w8g-wq8h-fq33
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
High
ghsa-5fqc-mrg8-w798
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
High
ghsa-cm62-gvxx-vmxx
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
High
CVE-2026-52726
Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
Low
CVE-2026-47712
Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Medium
CVE-2026-47734
Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
High
CVE-2026-42305
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
High
CVE-2026-42563
Dulwich Vulnerable to Command Injection via Merge Driver Path
Critical
CVE-2015-0838
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Critical
CVE-2014-9706
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly h
Critical
CVE-2017-16228
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.