Is CVE-2026-114095 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-114095?

CVE-2026-114095 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-114095

Description

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.