The Dulwich library prior to version 1.2.9 contains a flaw in the Pack.resolve_object routine that allows infinite recursion when processing self‑referential OFS_DELTA objects. An attacker can deliver a crafted packfile containing an OFS_DELTA with a delta_offset of zero, causing the resolution process to loop indefinitely. This excessive CPU consumption can stall clone, fetch, or cat‑file operations, effectively denying service to the target system.

All implementations that use the Dulwich library older than version 1.2.9 are affected. The vulnerability applies to any software that performs Git operations such as cloning, fetching, or reading repository data through Dulwich; no other vendor products are enumerated.

The CVSS score of 7.1 indicates a high‑severity issue. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must supply a malicious packfile that is processed by Pack.resolve_object; the CVE description confirms this requirement. The method of delivery is not specified in the data, so based on the description the attacker could use a compromised repository push or another external source to provide the exploit file, but these details are inferred rather than explicit.