Memory Allocation Flaw in Dulwich Git Implementation

CVE-2026-47734

What is CVE-2026-47734?

The Dulwich implementation of Git allows for excessive memory allocation when a specially crafted thin pack is pushed to a server. An attacker can exploit this by pushing a malicious packet that declares an oversized destination size, leading to memory usage that can severely affect server performance. This vulnerability primarily impacts operators using Dulwich-enabled Git servers with push access, as affected versions prior to 1.2.5 lack necessary input size checks. An update to version 1.2.5 is required to mitigate this issue effectively. Until then, it is recommended to either restrict push access to trusted clients or impose OS-level memory limits to prevent potential denial-of-service conditions.

References