CVE-2026-47734: Dulwich Git Library DoS Vulnerability

CVE-2026-47734 Overview

CVE-2026-47734 is a resource exhaustion vulnerability in Dulwich, a pure-Python implementation of the Git file formats and protocols. The flaw affects versions 0.1.0 through 1.2.4 and allows an authenticated client with push access to trigger excessive memory allocation. A crafted thin pack of roughly 174 bytes can declare a large dest_size in its delta header, causing add_thin_pack and apply_delta to allocate hundreds of megabytes regardless of actual wire data received. Operators running Dulwich-based Git servers that expose git-receive-pack through dulwich.server, the HTTP smart server, or anything built on ReceivePackHandler are affected. The issue is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A push-capable client can exhaust server memory and cause denial of service with a ~174-byte crafted pack.

Affected Products

Dulwich versions 0.1.0 through 1.2.4
Git servers exposing git-receive-pack via dulwich.server
Applications built on Dulwich's ReceivePackHandler or HTTP smart server

Discovery Timeline

2026-06-10 - CVE-2026-47734 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47734

Vulnerability Analysis

The vulnerability resides in Dulwich's thin pack ingestion path. Git thin packs use delta compression where each delta object includes header fields describing the source size and destination size. Dulwich trusted the attacker-controlled dest_size value declared in the delta header and pre-allocated memory accordingly.

Because the declared dest_size has no required relationship to the actual bytes transmitted, an attacker can send a tiny pack with an inflated size field. The server then allocates hundreds of megabytes of memory per request. Repeated pushes amplify the impact and can exhaust host memory, taking down the Git service.

The attack requires push access, meaning an authenticated client account on the target server. In environments where push credentials are widely distributed or self-service repository creation is allowed, the practical barrier is low.

Root Cause

The root cause is missing input validation on size fields read from untrusted pack data. The add_thin_pack and apply_delta functions allocate buffers based on declared sizes without enforcing a maximum input size or cross-checking against bytes actually received on the wire.

Attack Vector

The attacker authenticates to a Dulwich-backed Git server with push permission and initiates a git-receive-pack operation. The attacker transmits a crafted thin pack roughly 174 bytes in length whose delta header declares an oversized dest_size. Dulwich allocates memory proportional to the declared size rather than the received bytes, consuming server resources until the request is processed or the host runs out of memory.

No verified proof-of-concept code is published. Technical details are available in the GitHub Security Advisory GHSA-xrvj-v92f-53gj.

Detection Methods for CVE-2026-47734

Indicators of Compromise

Sudden spikes in resident memory usage by Dulwich server processes during git-receive-pack operations
Out-of-memory (OOM) kills of Dulwich server processes recorded in kernel or systemd logs
Short-lived push requests that immediately precede memory pressure events
Authenticated push activity from accounts that do not normally write to the repository

Detection Strategies

Monitor Dulwich process memory growth correlated with inbound git-receive-pack HTTP requests or SSH sessions
Alert on OOM-killer events targeting Python processes running Dulwich on Git server hosts
Track the ratio of received bytes to memory allocated per push and flag large discrepancies
Review authentication logs for push operations from unusual source IPs or service accounts

Monitoring Recommendations

Enable cgroup or container-level memory accounting on Dulwich service hosts to surface anomalous consumption
Forward Dulwich application logs and host memory metrics into a centralized analytics platform for correlation
Instrument ReceivePackHandler invocations with structured logging that records remote identity, pack size, and processing time
Baseline normal push volumes and pack sizes per repository to detect statistical outliers

How to Mitigate CVE-2026-47734

Immediate Actions Required

Upgrade Dulwich to version 1.2.5 or later on all servers that accept pushes
Set receive.maxInputSize in each repository's Git config to a bound appropriate for your workflows
Restrict git-receive-pack access to trusted, authenticated clients while the upgrade is rolled out
Apply OS-level memory limits via ulimit, cgroups MemoryMax, or container memory limits so a malicious push is killed rather than the host

Patch Information

The issue is fixed in Dulwich 1.2.5. The patch introduces a max_input_size keyword argument to add_thin_pack (in bytes; 0 or None means unlimited, matching Git's semantics). ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted, and a PackInputTooLarge exception is raised once the cap is exceeded, equivalent to git index-pack --max-input-size. Release details are available at the GitHub Release dulwich-1.2.5.

Workarounds

Disable git-receive-pack entirely on servers that only need to serve fetches
Restrict push access to a small set of authenticated, trusted clients until the patch is applied
Run the Dulwich server process under an OS-level memory cap using ulimit, cgroups MemoryMax, or container memory limits
Note that receive.maxInputSize has no effect on unpatched versions and cannot serve as a workaround on its own

bash

# Configuration example - after upgrading to Dulwich 1.2.5
# Set a per-repository input size cap (e.g., 100 MiB)
git config receive.maxInputSize 104857600

# Optional: run the service under a systemd memory cap
# /etc/systemd/system/dulwich.service.d/override.conf
# [Service]
# MemoryMax=512M