CVE-2026-47734

A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. A remote attacker with push access to a Dulwich-based Git server could send a specially crafted thin pack. This crafted pack, with a manipulated delta header, would cause the server to allocate excessive amounts of memory, leading to a Denial of Service (DoS) condition. This vulnerability allows an authenticated attacker to disrupt the availability of the Git server.

This Moderate impact denial of service flaw in Dulwich affects Red Hat products utilizing Dulwich-based Git server functionalities. An authenticated attacker with push access could send a crafted Git thin pack, causing excessive memory allocation and disrupting service availability. The vulnerability requires prior authentication, but its exploitation can lead to a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw is fixed in Dulwich 1.2.5, which adds a max_input_size limit to add_thin_pack and makes ReceivePackHandler honor the receive.maxInputSize repository configuration setting (equivalent to git index-pack --max-input-size). Upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in the Git server's repository configuration to a sensible bound for the environment. On unpatched versions, receive.maxInputSize has no effect and cannot be used as a workaround. Until the fixed version is deployed, operators of Dulwich-based Git servers that accept pushes can restrict git-receive-pack (push) access to trusted, authenticated clients only, or disable push access entirely on servers that only need to serve fetches. Running the server under an OS-level memory limit (for example ulimit, cgroups MemoryMax, or a container memory limit) can additionally ensure that a malicious push is killed rather than taking down the host.