CVE-2026-114095 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114095?
CVE-2026-114095 is a high-severity vulnerability in jelmer dulwich, published on 21 Oct 2026.
Official description
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
Weakness: CWE-835
Which versions are affected by CVE-2026-114095?
2 open source packages ship an affected version, including dulwich.
| Package | Affected | Fixed in |
|---|---|---|
dulwich PyPI | All versions | 1.2.9 |
dulwich PyPI | All versions | 1.2.9 |
How do I fix CVE-2026-114095?
Upgrade dulwich to 1.2.9 or later.
Is CVE-2026-114095 being exploited?
There is no known exploitation of CVE-2026-114095 in the wild and no public exploit code.
Sources
Also known as AZL-109893, DEBIAN-CVE-2026-114095, ECHO-c5e3-e788-b542, GHSA-35mr-4567-66vg, GHSA-r78r-wr5r-rqfm, MINI-596m-vr3f-9q26 and 2 more.