CVE-2026-114095 jelmer CVE debrief

Who should care

Defenders responsible for systems using Dulwich for packfile operations should assess exposure and prioritize verification and updates. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that Dulwich is updated to version 1.2.9 or later to prevent potential Denial of Service (DoS) attacks. Additionally, defenders should review compensating controls for exposed systems and implement

Why it matters

Defenders should prioritize verifying and updating Dulwich to version 1.2.9 or later, and assess exposure in systems using Dulwich for packfile operations, as an attacker can trigger an infinite loop via any operation that walks packfiles.

• Denial of Service (DoS) via infinite loop
• CPU resource exhaustion and process crash

Technical summary

The vulnerability exists in the Pack.resolve_object method of the Dulwich package. When resolving an OFS_DELTA object, the resolver calculates the base offset using base_offset = obj_offset - delta_offset. If a malicious packfile contains an OFS_DELTA object where delta_offset is 0, the calculation obj_offset - 0 resolves back to the current object's own offset, causing an infinite recursive loop.

Defensive priority

Defenders should prioritize verifying and updating Dulwich to version 1.2.9 or later, and assess exposure in systems using Dulwich for packfile operations.

Recommended defensive actions

• Verify and update Dulwich to version 1.2.9 or later
• Assess exposure in systems using Dulwich for packfile operations
• Implement additional monitoring and logging for packfile operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a lack of depth counter, visited set, or explicit rejection of delta_offset == 0 in the Pack.resolve_object method. This allows an attacker to trigger an infinite recursive loop.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.