Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-47734

Опубликовано: 10 июн. 2026
Источник: redhat
CVSS3: 6.5

Описание

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit, cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the host.

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. A remote attacker with push access to a Dulwich-based Git server could send a specially crafted thin pack. This crafted pack, with a manipulated delta header, would cause the server to allocate excessive amounts of memory, leading to a Denial of Service (DoS) condition. This vulnerability allows an authenticated attacker to disrupt the availability of the Git server.

Отчет

This Moderate impact denial of service flaw in Dulwich affects Red Hat products utilizing Dulwich-based Git server functionalities. An authenticated attacker with push access could send a crafted Git thin pack, causing excessive memory allocation and disrupting service availability. The vulnerability requires prior authentication, but its exploitation can lead to a system crash.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/controller-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/eda-controller-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-26/lightspeed-chatbot-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/controller-rhel9Fix deferred
Red Hat Ansible Automation Platform 2ansible-automation-platform-27/eda-controller-rhel9Fix deferred
Red Hat Enterprise Linux 7resource-agentsFix deferred
Red Hat Enterprise Linux 8resource-agentsFix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-agent-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-autogluon-server-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-kserve-controller-rhel9Fix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-1285
https://bugzilla.redhat.com/show_bug.cgi?id=2487774dulwich: Dulwich: Denial of Service via crafted Git thin pack

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.7
ubuntu
около 2 месяцев назад

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is ex...

CVSS3: 5.7
nvd
около 2 месяцев назад

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exce

CVSS3: 5.7
debian
около 2 месяцев назад

Dulwich is a pure-Python implementation of the Git file formats and pr ...

CVSS3: 5.7
github
около 2 месяцев назад

Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

6.5 Medium

CVSS3