Description (CNA)
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jelmer / dulwich | affected 0 before 1.2.9; unaffected 1.2.9 |
CWE
CWE-835
References
- https://github.com/jelmer/dulwich/security/advisories/GHSA-35mr-4567-66vg
- https://www.vulncheck.com/advisories/dulwich-before-1.2.9-infinite-loop-dos-via-pack-resolve-object
ADP enrichment
No English description supplied.
No references supplied.