Affected: Homebrew: breezy

### Affected file * `dulwich/pack.py` (Method: `Pack.resolve_object`)

### Description / Summary A High-severity Denial of Service (DoS) vulnerability exists in the `Pack.resolve_object` method. When resolving an `OFS_DELTA` object, the resolver calculates the base offset using `base_offset = obj_offset - delta_offset`.

If a malicious packfile contains an `OFS_DELTA` object where `delta_offset` is `0`, the calculation `obj_offset - 0` resolves back to the current object's own offset. Because the implementation lacks a depth counter, a "visited" set, or an explicit rejection of `delta_offset == 0`, the resolver enters an infinite recursive loop, exhausting CPU resources and eventually crashing the process.

**Vulnerable Code Breakdown (`dulwich/pack.py`):** ```python elif obj_type == OFS_DELTA: delta_offset = parse_pack_object_offset_at(...) base_offset = obj_offset - delta_offset # VULNERABILITY: Self-reference if delta_offset == 0 base_type, base_data = self.resolve_object(...) # VULNERABILITY: Infinite recursion ```

### Potential impact

An attacker can trigger this infinite loop via any operation that walks packfiles (e.g., `dulwich clone`, `fetch`, `cat-file`, or internal `Pack.__getitem__` lookups).

1. **CPU Exhaustion:** The process will spin at 100% CPU indefinitely. 2. **Denial of Service:** Any service using `dulwich` (web interfaces, CI/CD runners) will hang or crash, preventing legitimate repository access. 3. **Protocol Incompatibility:*…

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.

Affected: Ubuntu:16.04:LTS: dulwich, Ubuntu:18.04:LTS: dulwich, Ubuntu:20.04:LTS: dulwich, Ubuntu:22.04:LTS: dulwich, Ubuntu:24.04:LTS: dulwich, Ubuntu:26.04:LTS: dulwich

(Dulwich before 1.2.9 contains a denial of service vulnerability in Pac ...)