Dulwich, a pure‑Python implementation of Git, had a flaw in its pack‑accepting logic that allowed a client with push privileges to send a specially crafted thin pack containing a delta header that declares an extremely large destination size. When the server processed this pack, it allocated memory proportional to that declared size, decoupled from the actual data received, leading to an unbounded memory allocation. This flaw was rated CWE‑400 (Insufficient Limitation of a Resource or Input) and CWE‑789 (Uncontrolled Memory Allocation). The consequence is a denial‑of‑service on any computer that runs a Dulwich‑based Git server and accepts pushes, as the host can run out of memory or be killed by a memory‑pressure mechanism.

The vulnerability affects Dulwich deployments built from the Jelmer Dulwich project (vendor jelmer:dulwich). Any server that exposes the git‑receive‑pack service—whether via dulwich.server, an HTTP smart server, or any custom implementation using ReceivePackHandler—is at risk. The issue existed in all versions from the first release (0.1.0) through the pre‑release 1.2.4; it was resolved in Dulwich 1.2.5 and later.

The CVSS score for this issue is 5.7, indicating a moderate severity. No EPSS data is available and the vulnerability is not listed in CISA's KEV catalog, suggesting limited known exploitation. The attack vector is remote and requires that the adversary have push access to a Dulwich server. A malicious actor can craft a nearly 174‑byte thin pack with an inflated delta header and feed it to the server; the resulting memory allocation can exhaust system resources and cause the host or the Dulwich process to crash. Because receive.maxInputSize was only introduced in 1.2.5, unpatched installations have no built‑in mitigation and must rely on external controls such as access restrictions or OS‑level memory limits.