CVE-2026-47734: Dulwich Git Server Memory Exhaustion Vulnerability

Technical summary

The vulnerability stems from insufficient validation of delta header metadata in thin Git packs processed by the add_thin_pack and apply_delta functions. A malicious actor crafts a ~174-byte thin pack where the delta header's dest_size field contains an extremely large value. When Dulwich ingests this pack without enforcing input size limits, it allocates memory proportional to the declared dest_size rather than the actual received bytes, enabling heap exhaustion. This affects all Dulwich-based Git servers that expose git-receive-pack functionality, including those using dulwich.server, HTTP smart protocol handlers, and custom implementations built on ReceivePackHandler. The root cause involves unvalidated allocation based on attacker-controlled header data, classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-789 (Memory Allocation with Excessive Size Value).

Business impact

Organizations running Dulwich-based Git servers face service availability risk. An authenticated attacker can trigger denial-of-service by exhausting server memory with minimal network traffic, potentially rendering repositories inaccessible to development teams. This is particularly impactful for CI/CD pipelines, code review workflows, and distributed development environments that depend on continuous Git access. While the vulnerability requires authentication (push access), insider threats or compromised accounts pose realistic attack scenarios. Recovery typically requires manual server restart and investigation, disrupting development velocity.

Affected systems

All Dulwich versions from 0.1.0 through 1.2.4 are vulnerable. Vulnerable deployments include: (1) standalone Dulwich Git servers using dulwich.server module, (2) HTTP-based Git smart protocol implementations built with Dulwich, (3) custom Git receive handlers inheriting from ReceivePackHandler, and (4) any infrastructure automating git-receive-pack through Dulwich libraries. Self-hosted Git solutions, internal code repositories, and organizations that customized Dulwich for specialized Git operations are at higher risk than those using managed platforms like GitHub or GitLab.

Exploitability

Exploitability is moderate. The attack requires valid push credentials or account compromise, placing it outside the reach of unauthenticated network-based attacks. However, the barrier to crafting the malicious thin pack is low—an attacker need only understand Git pack format basics and manipulate a delta header. The payload is tiny (~174 bytes), making it easy to deliver and leaving minimal forensic traces. In environments with permissive access controls or shared credentials, exploitation likelihood increases significantly. The impact (denial-of-service via memory exhaustion) is reliable and deterministic once access is gained.

Remediation

Upgrade to Dulwich version 1.2.5 or later immediately. The patched version introduces a max_input_size parameter to add_thin_pack (configurable via receive.maxInputSize in repository config) and enforces wire read accounting with PackInputTooLarge exception handling, mirroring Git's native protections. After upgrading, configure receive.maxInputSize in each repository's config file to a value appropriate for your environment (e.g., 1 GB for typical use, lower for resource-constrained servers). On unpatched systems, this configuration setting has no protective effect. Until patching is feasible, restrict push access to a minimal set of trusted, authenticated users and consider disabling git-receive-pack entirely on servers that only serve fetch operations.

Patch guidance

Apply Dulwich version 1.2.5 or later via your package manager (pip, apt, etc.). Verify the installed version with 'dulwich --version' or by inspecting the package changelog. After upgrade, test in a staging environment to confirm compatibility with any custom Dulwich extensions or integrations. Update your repository configuration files to include a sensible receive.maxInputSize value (recommend starting with values between 512 MB and 2 GB depending on your largest typical push). Monitor server logs post-deployment for PackInputTooLarge exceptions, which may indicate either attack attempts or legitimate users exceeding the threshold—adjust the limit accordingly. If you maintain custom patches or forks of Dulwich, backport the max_input_size validation logic from the official 1.2.5 release.

Detection guidance

Monitor for PackInputTooLarge exceptions in Dulwich server logs—these indicate either blocked attacks or threshold violations. Correlate exception timestamps with push attempts from unexpected users or CI/CD systems. Enable Git server audit logging to capture push operations by user and timestamp. Watch for push attempts with unusually small payload sizes combined with high memory allocation events on the server (via /proc/meminfo or container metrics). Intrusion detection systems can flag thin pack operations from unexpected sources. If using systemd or cgroups, memory cgroup OOM-kill events coinciding with git-receive-pack processes may indicate exploitation. Establish a baseline of normal memory usage per push operation to detect anomalous allocation patterns.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS 5.7 (Medium) score reflects the authentication requirement and availability-only impact (no confidentiality or integrity compromise). However, Git infrastructure is foundational to development velocity and security; even brief outages disrupt CI/CD and code review. The low barrier to exploitation and ease of crafting the attack payload elevate real-world risk beyond the base score. Organizations with permissive push access, shared credentials, or critical development dependencies should prioritize this within 1-2 weeks. Those with strict access controls and robust monitoring can extend the timeline to 30 days, provided interim mitigations (access restrictions, memory limits) are in place. Public exploits or evidence of in-the-wild attacks would accelerate timeline to emergency status.

Risk score, explained

CVSS 5.7 reflects: Network-accessible attack surface (AV:N), low attack complexity requiring only pack format knowledge (AC:L), requirement for valid push credentials limiting reach (PR:L), user interaction assumed in the Git protocol flow (UI:R), no cross-boundary impact (S:U), zero confidentiality or integrity loss (C:N/I:N), and high availability impact from memory exhaustion (A:H). The score is appropriately calibrated for a denial-of-service attack on authenticated services. Real-world risk factors elevating urgency include: wide deployment of Dulwich in self-hosted environments, credential compromise likelihood, Git infrastructure's central role in development workflows, and the reliability of the attack mechanism.

Frequently asked questions