AIKIDO-2026-10554
dulwich is vulnerable to Improper Verification of Cryptographic Signature
78
High Risk
This Affects:
dulwichTL;DR
The GPG signature verification path in GPGSignatureVendor only treated a narrow GPG error type as a verification failure, so other GPG failure modes and the empty-signature case could be handled without a consistent BadSignature outcome. The object store, pack reading, and index change detection paths could consume very large memory or perform unbounded stat work on large trees because there were no configured caps for mmap footprint, delta base cache size, or stat budget. The Git smart server support is extended so push operations can honor an atomic option and avoid applying ref updates in a half-updated way when the client requests it.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
dulwich is vulnerable to Improper Verification of Cryptographic Signature in versions 0.0.1 - 1.1.0.
How to fix this
Upgrade the dulwich library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant