jelmer dulwich

• CVE-2026-122299 High 8.8 Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation 0.3%
• CVE-2026-114098 High 7.8 Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks 0.2%
• CVE-2026-114097 High 7.8 Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter 0.2%
• CVE-2026-114096 High 7.8 Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths 0.2%
• CVE-2026-114095 Medium 6.5 Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object 0.3%
• CVE-2026-114094 High 8.8 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths 0.9%
• CVE-2026-52726 High 7.5 Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload 0.4%
• CVE-2026-47734 Medium 5.7 Dulwich has unbounded memory allocation in receive-pack from crafted thin packs 0.2%
• CVE-2026-47712 Low 3.3 Dulwich doesn't sanitize commit subjects in `porcelain.format_patch` 0.1%
• CVE-2026-42305 High 8.8 Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows 0.6%
• CVE-2026-42563 High 7.7 Dulwich Vulnerable to Command Injection via Merge Driver Path 0.6%