{"id":"UBUNTU-CVE-2026-47734","details":"Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes)  whose delta header declares a huge   dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would  allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP  smart server, or anything built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit, cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the host.","modified":"2026-06-17T06:31:29.753286535Z","published":"2026-06-10T23:16:00Z","upstream":["CVE-2026-47734"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-47734"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-47734"},{"type":"REPORT","url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj"}],"affected":[{"package":{"name":"dulwich","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-1ubuntu1","0.12.0-1","0.12.0-1build1","0.12.0-1build2"],"ecosystem_specific":{"binaries":[{"binary_version":"0.12.0-1build2","binary_name":"pypy-dulwich"},{"binary_name":"python-dulwich","binary_version":"0.12.0-1build2"},{"binary_name":"python3-dulwich","binary_version":"0.12.0-1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}},{"package":{"name":"dulwich","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.18.2-1build1","0.18.5-1"],"ecosystem_specific":{"binaries":[{"binary_name":"pypy-dulwich","binary_version":"0.18.5-1"},{"binary_name":"python-dulwich","binary_version":"0.18.5-1"},{"binary_name":"python3-dulwich","binary_version":"0.18.5-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}},{"package":{"name":"dulwich","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.11-2","0.19.14-4ubuntu1","0.19.15-1","0.19.15-1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.19.15-1build1","binary_name":"pypy-dulwich"},{"binary_name":"python3-dulwich","binary_version":"0.19.15-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}},{"package":{"name":"dulwich","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.15-1ubuntu1","0.20.31-1ubuntu1","0.20.31-1.1","0.20.31-1.1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"0.20.31-1.1build1","binary_name":"python3-dulwich"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}},{"package":{"name":"dulwich","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.6-1","0.21.6-1build1","0.21.6-1build2"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-dulwich","binary_version":"0.21.6-1build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}},{"package":{"name":"dulwich","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-dulwich","binary_version":"0.22.7-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}},{"package":{"name":"dulwich","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/dulwich?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.22.7-1","0.24.2-2","1.1.0-2ubuntu1","1.1.0-3"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-dulwich","binary_version":"1.1.0-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-47734.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}