The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.1.0     and prior to version 1.2.5, a client with push access could push a tiny crafted thin pack (~174 bytes)     whose delta header declares a huge dest_size. When dulwich ingested it via add_thin_pack / apply_delta, it     would allocate hundreds of MB of memory based on that attacker-controlled size, with no relationship to     the actual bytes received. Operators running a Dulwich-based Git server that exposes git-receive-pack     (i.e. accepts pushes) - for example via dulwich.server functionality, the HTTP smart server, or anything     built on ReceivePackHandler - are impacted. The issue is patched in 1.2.5. add_thin_pack now accepts a     max_input_size keyword (bytes; 0/None = unlimited, matching git's semantics), and ReceivePackHandler reads     receive.maxInputSize from the repository config and passes it through. Wire reads are counted and a     PackInputTooLarge exception is raised once the cap is exceeded - equivalent to git index-pack --max-input-     size. Users should upgrade to Dulwich 1.2.5 or later and set receive.maxInputSize in their server's     repository config to a sane bound for their environment. On unpatched versions, receive.maxInputSize has     no effect, so it cannot be used as a workaround. Until upgrading, operators should restrict dulwich-     receive-pack (push) access to trusted, authenticated clients only, or disable it entirely on servers that     only need to serve fetches and/or run the server under an OS-level memory limit (e.g. ulimit,     cgroups/MemoryMax, or a container memory limit) so a malicious push is killed rather than taking down the     host. (CVE-2026-47734)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-47734

medium Nessus Plugin ID 317719

Version 1.5

Version 1.4

Version 1.2

Version 1.1

Version 1.5 Jun 12, 2026, 7:27 AM CVSS metrics ("CVSSv2 score" set to 4.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P") CVSSv2 severity (based on CVE-2026-47734, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606120727
Version 1.4 Jun 11, 2026, 6:45 PM CVSS metrics ("CVSSv2 score" set to 3.5. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H". "CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P". "CVSSv3 score" set to 5.7) CVSSv2 severity (based on CVE-2026-47734, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Plugin metadata Plugin Feed: 202606111845
Version 1.2 May 30, 2026, 12:49 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202605301249
Version 1.1 May 29, 2026, 5:27 PM New Plugin Feed: 202605291727