Poetry: Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

The vulnerability in dulwich's Pack.resolve_object method arises when resolving OFS_DELTA objects. The base offset is calculated as obj_offset - delta_offset. If delta_offset is zero, this calculation results in the base offset being the same as the current object's offset, causing infinite recursion without a depth limit or cycle detection. This leads to CPU exhaustion and denial of service in any operation that processes packfiles, such as cloning or fetching repositories. The issue violates Git packfile specifications, which disallow delta_offset of zero. A proof-of-concept demonstrates the infinite loop triggered by a crafted packfile. The recommended fix is to add an explicit check rejecting delta_offset == 0 and to implement recursion depth limits.

An attacker can cause any dulwich-based service or tool to enter an infinite loop consuming 100% CPU by providing a malicious packfile with an OFS_DELTA object having delta_offset of zero. This results in denial of service by hanging or crashing processes that perform packfile operations such as cloning, fetching, or object lookups. There is no impact on confidentiality or integrity, but availability is severely affected.

A patch is available that adds an explicit check in Pack.resolve_object to reject delta_offset values of zero, preventing infinite recursion. Additionally, implementing a recursion depth limit can mitigate long delta chains. Users should upgrade dulwich to a fixed version >=2.4.2 or apply the patch provided by the vendor. No other mitigation is required once patched.