PyPI/dulwich CVE-2026-47734: medium 5.7, EPSS 0.19%

Dulwich has unbounded memory allocation in receive-pack from crafted thin packs

Action: Upgrade dulwich to 1.2.5 or later.

pip install dulwich==1.2.5

Affected

Fixed versions

Sources

• osv: GHSA-xrvj-v92f-53gj
• https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj
• https://nvd.nist.gov/vuln/detail/CVE-2026-47734
• https://github.com/jelmer/dulwich
• https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5

CVE-2026-47734 · published 2026-06-08T23:43:42Z · modified 2026-07-13T16:43:32.716665118Z · JSON