AIKIDO-2026-855580
dulwich is vulnerable to Improper Validation of Integrity Check Value
42
Medium Risk
This Affects:
dulwichTL;DR
Pack.bitmap loads a .bitmap index and uses its object positions against the pack's index without comparing the pack checksum recorded in the bitmap header. read_bitmap/read_bitmap_file store this checksum but never validate it, so a stale bitmap left after a repack or one swapped in from a different pack is silently accepted and applied to the wrong object set, causing incorrect reachable-object computation during fetch negotiation. The fix verifies an optional pack_checksum on read, raises ChecksumMismatch on a mismatch, and has Pack.bitmap fall back to graph traversal instead of trusting an unverified bitmap.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application relies on pack bitmap indexes for reachability queries where a .bitmap file could be stale or come from an untrusted or shared repository.
Background info
dulwich is vulnerable to Improper Validation of Integrity Check Value in versions 0.25.0 - 1.2.10.
How to fix this
Upgrade the dulwich library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant