https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-16228.htmlhttps://patchthecve.com/cve/CVE-2017-16228.htmlWed, 17 Jun 2026 01:09:00 +0000CRITICAL 9.8: Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.https://patchthecve.com/cve/CVE-2015-0838.htmlhttps://patchthecve.com/cve/CVE-2015-0838.htmlWed, 17 Jun 2026 00:21:00 +0000HIGH 7.5: Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.https://patchthecve.com/cve/CVE-2014-9706.htmlhttps://patchthecve.com/cve/CVE-2014-9706.htmlWed, 17 Jun 2026 00:18:50 +0000HIGH 7.5: The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.