These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for validating NTFS paths strictly reject `.git` variants, Alternate Data Streams (ADS), `git~1` short names, and reserved device names, but they completely fail to check for **DOS drive letter prefixes**. A malicious Git tree can contain an entry named `C:`. When Dulwich proc [truncated]
A High-severity Denial of Service (DoS) vulnerability exists in the `Pack.resolve_object` method of the Dulwich package. An attacker can trigger an infinite loop via any operation that walks packfiles, exhausting CPU resources and eventually crashing the process. This vulnerability is caused by a lack of depth counter, visited set, or explicit rejection of delta_offset == 0 in the Pack.resolve_object meth [truncated]
Dulwich's `porcelain.checkout(paths=[...])` writes files using raw `os.open(file_path, O_WRONLY|O_CREAT|O_TRUNC, mode)` followed by `f.write(obj.data)`, bypassing symlink protections and allowing arbitrary file writes. This occurs because the `_checked_worktree_path()` function only performs name validation and does not detect filesystem symlinks, leading to potential security risks in systems using Dulwi [truncated]
Dulwich's `filter_branch.py` `CommitFilter._apply_index_filter()` is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries (including symlinks) persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file writes from a descendant commit to arbitrary filesystem locations.
Dulwich's `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. This vulnerability exists due to the function's use of `os.path.exists(parent_dir)` to check if a parent directory exists before writing stashed files, which can be exploited by an attacker to w [truncated]
A vulnerability was discovered in Dulwich, a pure-Python implementation of the Git file formats and protocols. The issue affects versions starting from 0.23.2 up to, but not including, 1.2.5. Specifically, the `dulwich.porcelain.submodule_update` and `porcelain.clone(..., recurse_submodules=True)` functions do not validate paths from a crafted upstream repository. This allows an attacker to write submodul [truncated]
CVE-2026-47734 is a MEDIUM-severity vulnerability in Dulwich, a pure-Python implementation of Git file formats and protocols. The issue allows a client with push access to cause a denial of service by pushing a crafted thin pack that declares a huge dest_size, leading to excessive memory allocation. This vulnerability affects operators running a Dulwich-based Git server that exposes git-receive-pack. The [truncated]
CVE-2026-47712 is a security vulnerability in Dulwich, a pure-Python implementation of Git file formats and protocols. The vulnerability exists in the `dulwich.porcelain.format_patch` function, which derives patch filenames from commit subject lines. An attacker can exploit this vulnerability by crafting a malicious commit subject that directs the generated patch file outside the requested output director [truncated]
CVE-2026-42563 is a HIGH severity vulnerability in Dulwich, a pure-Python implementation of Git file formats and protocols. The vulnerability affects versions 0.24.0 to 1.2.4 of Dulwich. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths. The vulnerability is due to the `ProcessMergeDriver` substituting the file path fro [truncated]
Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Contributing [truncated]