Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0 and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes) whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit, cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the host.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbd55e52fb advisory.

    1.2.9, CVE fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0
    and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes)
    whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it
    would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to
    the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack
    (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything
    built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a
    max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads
    receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a
    PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-
    size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's
    repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has
    no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-
    receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that
    only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit,
    cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the
    host. (CVE-2026-47734)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0     and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes)     whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it     would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to     the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack     (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything     built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a     max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads     receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a     PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-     size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's     repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has     no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-     receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that     only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit,     cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the     host. (CVE-2026-47734)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326391	Fedora 44 : python-dulwich (2026-fbd55e52fb)	Nessus	Fedora Local Security Checks	high
443077	SCA: security update for dulwich (GHSA-xrvj-v92f-53gj)	Tenable Cloud Security	SCA Checks	medium
443077	SCA: security update for dulwich (GHSA-xrvj-v92f-53gj)	Tenable Self-Hosted Container Security	SCA Checks	medium
317719	Linux Distros Unpatched Vulnerability : CVE-2026-47734	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-47734

medium

Tenable Plugins

high

medium

medium

medium