{"id":"CVE-2026-87819","title":"GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields","summary":"GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1333","CWE-400"],"vendor":"gitpython_project","product":"gitpython","affected":["gitpython < 3.1.60"],"patched":["gitpython 3.1.60"],"published":"2026-09-09","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:34.697","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos","label":"disclosure@vulncheck.com"},{"url":"https://github.com/gitpython-developers/GitPython/pull/2215"},{"url":"https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8"},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml"},{"url":"https://github.com/advisories/GHSA-g5vv-9gxw-82hx"},{"url":"https://github.com/gitpython-developers/GitPython"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87819.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87819"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530742"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87819"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87819"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114"},{"url":"https://access.redhat.com/errata/RHSA-2026:71113"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","cve.org","osv","pip","ghsa","csaf","vex","red-hat"],"epss":0.00521,"epssPercentile":0.44051,"aliases":["PYSEC-2026-3984","GHSA-g5vv-9gxw-82hx"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-18T17:09:07.925027Z"},"ingestedAt":"2026-09-09T12:08:31.841Z","slug":"CVE-2026-87819","body":"## Overview\n\nGitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.\n\n## Affected\n\n- `gitpython < 3.1.60`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gitpython 3.1.60`\n\n## Package advisory (CVE-2026-87819)\n\nAffected packages:\n\n- `gitpython < 3.1.60`\n\nPatched in:\n\n- `gitpython 3.1.60`\n\nSource: https://osv.dev/vulnerability/PYSEC-2026-3984\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenStack Platform 16.2, … · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, Red Hat Ansible Automation Platform 2, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87819.json)\n- **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114)\n- **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}