---
id: CVE-2026-87819
title: >-
  GitPython before 3.1.60 contains a regular expression denial of service
  vulnerability in Actor.name_email_regex that processes commit author and
  committer fields
summary: >-
  GitPython before 3.1.60 contains a regular expression denial of service
  vulnerability in Actor.name_email_regex that processes commit author and
  committer fields. Attackers can craft a commit object with a malformed author
  field containi…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1333
  - CWE-400
vendor: gitpython_project
product: gitpython
affected:
  - gitpython < 3.1.60
patched:
  - gitpython 3.1.60
published: '2026-09-09'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:34.697'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87819'
references:
  - url: >-
      https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos
    label: disclosure@vulncheck.com
  - url: 'https://github.com/gitpython-developers/GitPython/pull/2215'
  - url: >-
      https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8
  - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml
  - url: 'https://github.com/advisories/GHSA-g5vv-9gxw-82hx'
  - url: 'https://github.com/gitpython-developers/GitPython'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87819.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-87819'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2530742'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-87819'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87819'
  - url: 'https://access.redhat.com/errata/RHSA-2026:71114'
  - url: 'https://access.redhat.com/errata/RHSA-2026:71113'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
tags:
  - nvd
  - cve.org
  - osv
  - pip
  - ghsa
  - csaf
  - vex
  - red-hat
epss: 0.00521
epssPercentile: 0.44051
aliases:
  - PYSEC-2026-3984
  - GHSA-g5vv-9gxw-82hx
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-18T17:09:07.925027Z'
ingestedAt: '2026-09-09T12:08:31.841Z'
---

## Overview

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

## Affected

- `gitpython < 3.1.60`

## Remediation

Upgrade past the affected range:

- `gitpython 3.1.60`

## Package advisory (CVE-2026-87819)

Affected packages:

- `gitpython < 3.1.60`

Patched in:

- `gitpython 3.1.60`

Source: https://osv.dev/vulnerability/PYSEC-2026-3984

## Vendor advisories

- **Red Hat VEX** · Important · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenStack Platform 16.2, … · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, Red Hat Ansible Automation Platform 2, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87819.json)
- **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114)
- **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113)
- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)