Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dulwich | pip | >= 0.1.0, < 1.2.5 | 1.2.5 |
Miggo AIRoot Cause AnalysisThe vulnerability is a memory exhaustion denial-of-service (CWE-400, CWE-789) in Dulwich's git server implementation. An attacker can push a small, specially crafted 'thin pack' to a vulnerable server. This pack contains a delta object whose header declares an extremely large destination size. The Dulwich server code, prior to the patch, would trust this size and attempt to allocate a corresponding amount of memory, leading to a denial of service.
The analysis of the patch commit f860ca489d63624ae6d7c7945fbbd19018b8125c reveals the exact functions involved. The core of the vulnerability lies in dulwich.object_store.add_thin_pack, which processes the pack file and is tricked into allocating excessive memory. The attack is initiated through the server's git-receive-pack handler, specifically dulwich.server.ReceivePackHandler._apply_pack, which takes the raw pack from the client and passes it to add_thin_pack.
The patch introduces a max_input_size check. The ReceivePackHandler is modified to read a receive.maxInputSize value from the repository's configuration and passes this limit to add_thin_pack. The add_thin_pack function is updated to enforce this limit on the incoming data stream, preventing the oversized allocation from occurring. Therefore, any runtime profile of an exploit would show calls progressing through ReceivePackHandler._apply_pack to add_thin_pack, where the vulnerable allocation would be attempted.
dulwich.object_store.add_thin_packdulwich/object_store.py
dulwich.server.ReceivePackHandler._apply_packdulwich/server.py