AIKIDO-2026-855580

dulwich is vulnerable to Improper Validation of Integrity Check Value

Improper Validation of Integrity Check Value Pre-CVE Published Jul 20, 2026

Medium Risk

This Affects:

dulwich

0.25.0 - 1.2.10

Fixed in 1.2.11

Are you affected? Scan for Free

TL;DR

Pack.bitmap loads a .bitmap index and uses its object positions against the pack's index without comparing the pack checksum recorded in the bitmap header. read_bitmap/read_bitmap_file store this checksum but never validate it, so a stale bitmap left after a repack or one swapped in from a different pack is silently accepted and applied to the wrong object set, causing incorrect reachable-object computation during fetch negotiation. The fix verifies an optional pack_checksum on read, raises ChecksumMismatch on a mismatch, and has Pack.bitmap fall back to graph traversal instead of trusting an unverified bitmap.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application relies on pack bitmap indexes for reachability queries where a .bitmap file could be stale or come from an untrusted or shared repository.