CVE-2015-0838: Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allo...

Security readout for executives and security teams

Dulwich, a Git library, had a buffer overflow in its C apply_delta code before 0.9.9. A malicious Git pack file could let a remote attacker run code in the process parsing it. Treat this as high priority where Dulwich processes repositories or pack files from untrusted sources. Exposure is likely limited to applications, automation, or services using Dulwich before 0.9.9, especially where they fetch, import, mirror, or inspect Git data supplied by remote or untrusted parties. Prioritize remediation for systems that process external Git data. The impact is potentially severe because code execution is cited, but available sources do not confirm exploitation in the wild. Mitigation focus: Upgrade Dulwich to 0.9.9 or later where directly installed.; Apply Debian or other distribution security updates for packaged Dulwich.; Review vendor advisories for supported backported fixes..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.