CVE-2026-114095 in Dulwich
Summary
by MITRE • 10/22/2026
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The Dulwich library, prior to version 1.2.9, contains a critical denial of service vulnerability within the Pack.resolve_object function that stems from improper handling of self-referential OFS_DELTA objects in Git packfiles. This flaw allows remote attackers to trigger infinite recursion by supplying a maliciously crafted packfile where an OFS_DELTA entry specifies a delta_offset of zero relative to itself or another object that eventually references back, creating a circular dependency chain. When the library attempts to resolve these deltas during operations such as clone, fetch, or cat-file, it enters an unbounded recursive loop because the base resolution logic fails to detect and break this cycle effectively.
From a technical perspective, OFS_DELTA is a mechanism in Git packfiles used to store objects by referencing their delta bases with offset-based pointers rather than SHA-1 hashes for efficiency. The vulnerability arises when the resolver encounters a situation where an object's delta base points back to itself or creates a loop through other objects without reaching a non-delta base object that can be resolved directly. This condition causes the resolve_object function to call itself repeatedly, consuming system resources until the stack is exhausted or the process is terminated by the operating system due to resource limits. The lack of depth limiting or cycle detection in older versions of Dulwich means there is no safeguard against these pathological inputs.
The operational impact of this vulnerability is significant for any service that processes untrusted Git repositories, including code hosting platforms, continuous integration systems, and local development environments where users might clone from compromised sources. An attacker can exploit this by distributing a malicious repository containing the crafted packfile, leading to resource exhaustion on the victim's machine or server. This results in a denial of service condition characterized by high CPU usage and potential application crashes, disrupting availability for legitimate users. The attack vector is particularly dangerous because it does not require authentication if the target operation involves fetching from public repositories or processing user-provided repository URLs.
This vulnerability aligns with CWE-674, which describes Uncontrolled Recursion, as the flaw lies in the failure to limit recursion depth when resolving object dependencies. It also maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under resource exhaustion via infinite loops or recursive calls. To mitigate this risk, organizations should immediately upgrade Dulwich to version 1.2.9 or later, where the issue has been patched with improved cycle detection and recursion limits in the pack resolution logic. Additionally, defensive measures such as implementing timeout mechanisms for object resolution processes and validating input from untrusted sources can provide additional layers of protection against similar exploitation attempts in related software components.