p PatchFirst

CVE-2026-38974

CVE-2026-38974

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • dulwich Debian:12

    Versions
    • 0.21.2-1
    • 0.21.5-1
    • 0.21.6-1
    • 0.22.5-1
    • 0.22.7-1
    • 0.22.7-2
    • 0.24.10-1
    • 0.24.2-1
    • 0.24.2-2
    • 1.0.0-1
    • 1.0.0-2
    • 1.1.0-1
    • 1.1.0-2
    • 1.1.0-3
    • 1.2.0-1
    • 1.2.1-1
    • 1.2.11-1
    • 1.2.12-1
    • 1.2.5-1
    • 1.2.7-1
    • 1.2.7-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Debian:13

    Versions
    • 0.22.7-1
    • 0.22.7-2
    • 0.24.10-1
    • 0.24.2-1
    • 0.24.2-2
    • 1.0.0-1
    • 1.0.0-2
    • 1.1.0-1
    • 1.1.0-2
    • 1.1.0-3
    • 1.2.0-1
    • 1.2.1-1
    • 1.2.11-1
    • 1.2.12-1
    • 1.2.5-1
    • 1.2.7-1
    • 1.2.7-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Debian:14

    Versions
    • 0.22.7-1
    • 0.22.7-2
    • 0.24.10-1
    • 0.24.2-1
    • 0.24.2-2
    • 1.0.0-1
    • 1.0.0-2
    • 1.1.0-1
    • 1.1.0-2
    • 1.1.0-3
    Affected ranges
    • ECOSYSTEM: < 1.2.0-1

    Update to 1.2.0-1

  • dulwich Ubuntu:16.04:LTS

    Versions
    • 0.11.2-1ubuntu1
    • 0.12.0-1
    • 0.12.0-1build1
    • 0.12.0-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Ubuntu:18.04:LTS

    Versions
    • 0.18.2-1build1
    • 0.18.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Ubuntu:20.04:LTS

    Versions
    • 0.19.11-2
    • 0.19.14-4ubuntu1
    • 0.19.15-1
    • 0.19.15-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Ubuntu:22.04:LTS

    Versions
    • 0.20.15-1ubuntu1
    • 0.20.31-1ubuntu1
    • 0.20.31-1.1
    • 0.20.31-1.1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Ubuntu:24.04:LTS

    Versions
    • 0.21.6-1
    • 0.21.6-1build1
    • 0.21.6-1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Ubuntu:26.10

    Versions
    • 1.1.0-3
    • 1.2.12-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • dulwich Ubuntu:26.04:LTS

    Versions
    • 0.22.7-1
    • 0.24.2-2
    • 1.1.0-2ubuntu1
    • 1.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →