jelmer has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The most common weakness class is CWE-22 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-114094High· 8.8Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths48CVE-2026-114098High· 7.8Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks43CVE-2026-114097High· 7.8Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter43CVE-2026-114096High· 7.8Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths43CVE-2026-114095Medium· 6.5Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object36
jelmer vulnerabilities
CVEs affecting jelmer, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-114094High· 8.8Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation a…
CVE-2026-114096High· 7.8Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository whe…
CVE-2026-114095Medium· 6.5Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object
Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA …
CVE-2026-114098High· 7.8Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repos…
CVE-2026-114097High· 7.8Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craf…