CVE-2026-38974 Dulwich CVE debrief

Who should care

Users of Dulwich through version 1.1.0 who utilize SSH connections should verify their configurations to ensure proper host key verification is in place. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their systems and take necessary actions.

Technical summary

The Dulwich library, specifically through version 1.1.0, contains a vulnerability in the contrib/paramiko_vendor.py file where SSH host key verification is not performed. This oversight could potentially allow for man-in-the-middle attacks if an attacker can intercept and modify the communication between the client and server. The vulnerability is classified as medium severity with a CVSS score of 5.3. Users of Dulwich through version 1.1.0 who utilize SSH connections should verify their configurations to ensure proper host key verification is in place.

Defensive priority

Medium priority due to the potential for interception and modification of sensitive data. This vulnerability requires immediate attention to prevent potential man-in-the-middle attacks.

Recommended defensive actions

• Verify Dulwich configurations for proper SSH host key verification.
• Update Dulwich to a version that includes SSH host key verification if available.
• Implement compensating controls such as additional authentication mechanisms.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence is limited; verification of the vulnerability and affected versions is needed. The Dulwich library, specifically through version 1.1.0, contains a vulnerability in the contrib/paramiko_vendor.py file where SSH host key verification is not performed. This oversight could potentially allow for man-in-the-middle attacks if an attacker can intercept and modify the communication between the client and server. Users of Dulwich through version 1.1.0 who utilize SSH connections should verify their configurations to ensure proper host key verification is in place.

Official resources