Hi,

The following vulnerability was published for dulwich.

CVE-2026-122299[0]:
| Dulwich before 1.2.20 contains a commit object parsing vulnerability
| where the read path in _parse_commit resolves a duplicate tree
| header to the last occurrence instead of the first, diverging from
| core git's resolution behavior, while Poetry 2.5.1 ships this
| version and uses dulwich by default for git dependency installation.
| Attackers can craft a commit object with two tree headers so that
| reviewers and CI using git see a benign tree while Poetry's dulwich-
| based checkout resolves to a different attacker-controlled tree
| containing malicious build scripts such as setup.py, resulting in
| unreviewed code execution on the install or build host.

Fixed by: https://github.com/jelmer/dulwich/commit/b77f385b4b0d2d2c7f5ac39dae628948f7ad3a96 (dulwich-1.2.20)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-122299
https://www.cve.org/CVERecord?id=CVE-2026-122299

Please adjust the affected versions in the BTS as needed.