← All advisories

Medium severity5.3OSV Advisory· Published Jul 15, 2026· Updated Jul 16, 2026

CVE-2026-38974

CVE-2026-38974

Description

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

Affected products

2

Dulwich Project/Dulwichllm-create2 versions
<=1.1.0+ 1 more
- (no CPE)range: <=1.1.0
- (no CPE)range: dulwich-1.0.0, dulwich-0.25.2, dulwich-0.25.1, …

Patches

Vulnerability mechanics

References

1

github.com/jelmer/dulwich/pull/2123nvd

News mentions

0

No linked articles in our index yet.