Medium severity6.5NVD Advisory· Published Oct 21, 2026· Updated Oct 21, 2026

CVE-2026-114095

Description

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

Affected products

Dulwich Project/Dulwichllm-fuzzy
Range: <1.2.9

Patches

Vulnerability mechanics

References

github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vgnvd
www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-objectnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000