jelmer Dulwich Vulnerabilities

Jelmer Dulwich vulnerabilities.

JSON RSS CSV 🔔 Create Alert Trigger

10 June 2026

Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload
CVE-2026-52726
JelmerDulwich7.5HIGH
Dulwich has unbounded memory allocation in receive-pack from crafted thin packs
CVE-2026-47734
JelmerDulwich5.7MEDIUM
Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
CVE-2026-47712
JelmerDulwich3.3LOW
Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows
CVE-2026-42305
JelmerDulwich8.8HIGH
Dulwich Vulnerable to Command Injection via Merge Driver Path
CVE-2026-42563
JelmerDulwich7.7HIGH