{"id":"CVE-2026-114095","published":"2026-10-21T01:17:34.763","lastModified":"2026-10-21T16:17:30.937","description":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwes":["CWE-835"],"vendors":[],"products":[],"references":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg","tags":[]},{"url":"https://www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-object","tags":[]}],"exploitRefs":[{"url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg","tags":[]}],"hasPoc":true,"ai":null}