The vulnerability exists in the Dulwich library version 1.1.0, where the SSH host key verification step is omitted in the contrib/paramiko_vendor.py module. This omission means that any SSH connection initiated by Dulwich will accept the server key without confirmation, thereby allowing a malicious actor to perform a man‑in‑the‑middle attack on the SSH session. The impact is a loss of confidentiality and integrity for data transmitted over the SSH channel, and a loss of authentication assurance for the client.

Affected systems are installations that use the Dulwich Python library, particularly version 1.1.0. Any projects, services, or scripts that rely on Dulwich for SSH communication will be exposed, regardless of the operating system or deployment environment.

The CVSS score of 5.3 indicates a medium severity vulnerability, while the EPSS score of less than 1% implies a very low probability of currently observed exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over SSH; the attacker would need to establish an SSH session to the target and could subvert it by presenting a rogue host key. No special privileges are required on the client side, but successful exploitation requires the client to connect to a target server over SSH that the attacker can control or intercept.