SSH Host Key Verification Flaw in Dulwich by Jelmer
CVE-2026-38974

Currently unrated

Key Information:

Vendor

Jelmer

Status
Dulwich
Vendor
CVE Published:
15 July 2026

What is CVE-2026-38974?

A vulnerability in Dulwich, specifically in the contrib/paramiko_vendor.py file, allows for the absence of SSH host key verification. This oversight can leave systems vulnerable to man-in-the-middle attacks, where malicious actors could impersonate legitimate servers. Users of Dulwich up to version 1.1.0 are advised to implement additional security measures until a fix is applied. Review the official GitHub repository for further details.

References

https://github.com/jelmer/dulwich/pull/2123
https://github.com/jelmer/dulwich

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.