CVE-2026-114095

A flaw was found in dulwich. When resolving Git packfile objects, the delta offset calculation fails to properly validate self-referential entries. An attacker can exploit this issue by providing a specially crafted Git packfile during repository operations such as clone or fetch, triggering infinite recursion. This leads to excessive CPU consumption, causing the application to hang or crash and resulting in a Denial of Service (DoS).

Red Hat rates this vulnerability as having a Moderate impact because exploitation is restricted to denial of service and requires processing untrusted Git repositories, with no compromise to confidentiality or system integrity. When handling a specially crafted repository packfile containing circular delta references, the parsing routine enters an unbounded recursive loop, causing high CPU consumption and hanging or terminating the affected application process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.