CVE-2015-0838: Buffer Overflow in Dulwich
Summary
CVE-2015-0838: Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file. Affects dulwich versions < 0.9.9. Fixed in 0.9.9. How to fix ↓
Also tracked for
- dulwich · Debian:11
The same CVE-2015-0838 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dulwich is a Python library that provides an interface to interact with Git repositories. It allows users to perform various Git operations programmatically. The library is widely used in Python projects that require Git functionality. However, versions of Dulwich prior to 0.9.9 are vulnerable to a buffer overflow.
Vulnerability Detail
The vulnerability, identified as CVE-2015-0838, is a buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich. This vulnerability can be exploited by remote attackers through a crafted pack file. By exploiting this vulnerability, an attacker can execute arbitrary code on the target system. The buffer overflow occurs due to improper input validation and can lead to a variety of security issues, including remote code execution.
How To Fix
Latest published version: 1.2.19 as of 23 Oct 2026
pip install --upgrade "dulwich==1.2.19"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.9
This is the first release that contains the fix.
pip install --upgrade "dulwich==0.9.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, Dulwich versions prior to 0.9.9 are vulnerable to a buffer overflow issue. This vulnerability can be exploited by remote attackers to execute arbitrary code on the target system. To mitigate the risk, it is recommended to update Dulwich to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dulwich →
FAQ
Dulwich is a Python library that provides an interface to interact with Git repositories. It allows users to perform various Git operations programmatically.
The vulnerability allows remote attackers to execute arbitrary code on the target system by exploiting a buffer overflow in Dulwich.
To fix this vulnerability, update Dulwich to version 0.9.9 or later by running 'pip install --upgrade dulwich'.
No specific workarounds have been provided for this vulnerability.
You can find more information about this vulnerability in the Dulwich advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/dulwich/PYSEC-2015-35.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for dulwich.
