Skip to main content

Dulwich CVE-2026-38974

| EUVDEUVD-2026-44852 MEDIUM
Improper Certificate Validation (CWE-295)
2026-07-15 mitre GHSA-h7fr-r783-5g99
Information Disclosure Red Hat N A Suse
5.3
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
4.8 MEDIUM

MITM network positioning elevates AC to H; missing host key verification enables both data interception (C:L) and content injection (I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 16, 2026 - 19:24 vuln.today
Analysis Generated
Jul 16, 2026 - 19:24 vuln.today
CVSS changed
Jul 16, 2026 - 19:22 NVD
5.3 (MEDIUM)
CVE Published
Jul 15, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

AnalysisAI

Missing SSH host key verification in Dulwich's paramiko vendor module exposes SSH connections to man-in-the-middle interception. The contrib/paramiko_vendor.py module used paramiko's MissingHostKeyPolicy, which silently accepts any server host key without checking it against known_hosts, allowing a network-positioned attacker to impersonate a legitimate SSH Git server. No public exploit has been identified at time of analysis and EPSS sits at 0.14% (4th percentile), but the attack is conceptually straightforward for any attacker with network access between client and server.

Technical ContextAI

Dulwich is a pure-Python implementation of the Git protocol, including SSH transport via the paramiko library (contrib/paramiko_vendor.py). The root cause is CWE-295 (Improper Certificate/Key Validation): when establishing SSH connections, the code set paramiko.client.MissingHostKeyPolicy() as the missing-host-key policy. This policy does not reject, warn, or verify - it silently accepts any presented server key. The fix (PR #2123) replaces this with paramiko.RejectPolicy() and adds a _load_host_keys() helper that loads system host keys and user-specified known_hosts files (via globalknownhostsfile/userknownhostsfile SSH config entries) before connecting, making the vendor fail-closed by default.

RemediationAI

The upstream fix is available in GitHub pull request #2123 (https://github.com/jelmer/dulwich/pull/2123), which replaces the permissive MissingHostKeyPolicy with RejectPolicy and adds proper known_hosts loading. A released patched version is not independently confirmed from available data - users should monitor the Dulwich release page at https://github.com/jelmer/dulwich and upgrade to the first release that includes PR #2123. As a compensating control until a patched release is available, operators can override the paramiko transport by using Dulwich's subprocess-based SSH vendor (which delegates to the system ssh binary and inherits its host key verification) rather than the paramiko vendor, or switch to HTTPS transport where applicable. Restricting the network path between Dulwich clients and SSH Git servers (e.g., using SSH through a VPN or internal-only network) reduces MITM exposure.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-295 – Improper Certificate Validation

View all
CVE-2015-3152 MEDIUM POC
5.9
CVE-2026-85102 CRITICAL POC
9.8
CVE-2017-2800 CRITICAL POC
9.8
CVE-2014-1266 HIGH POC
7.4
CVE-2022-47758 CRITICAL POC
9.8
CVE-2025-68121 CRITICAL POC
10.0
CVE-2025-29331 CRITICAL POC
9.8
CVE-2025-32878 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-38974 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy