CVE-2026-42305

A flaw was found in Dulwich, a pure-Python implementation of the Git file formats and protocols. A remote attacker could exploit this vulnerability by enticing a user on a Windows system to clone or check out a specially crafted malicious Git repository. This could lead to an arbitrary file write, ultimately resulting in remote code execution on the affected system.

This is an Important flaw in Dulwich, a Python Git library, primarily impacting Windows systems. While Red Hat Enterprise Linux and other POSIX-based Red Hat products are not directly vulnerable to remote code execution, they can serve as vectors for propagating malicious Git repositories to Windows clients. Exploitation occurs when a user clones or checks out a specially crafted repository on a Windows system, leading to arbitrary file write and potential remote code execution.

Red Hat Satellite ships the python-dulwich package however, this flaw primarily affects Dulwich when cloning or checking out a malicious Git repository on Windows, where NTFS path handling can lead to arbitrary file write and remote code execution. Red Hat Satellite runs on Red Hat Enterprise Linux and other POSIX platforms, where this Windows-specific path behavior does not apply. Therefore, Red Hat Satellite is not directly affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue involves avoiding the cloning, fetching, or checking out of untrusted Git repositories with Dulwich. This operational control is crucial for preventing the introduction and propagation of malicious content, especially when Red Hat systems interact with or serve Windows clients that utilize Dulwich.