GHSA-qpf5-3wfw-fh7qHigh· 7.5▾ TwilightDuplicate Advisory: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-g5vv-9gxw-82hx. This link is maintained to preserve external references.
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
gitpython <= 3.1.59Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87819High· 7.5GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields
GHSA-m64x-33q8-m5h7HighGitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
CVE-2026-110856High· 7.5GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines
GHSA-w8jc-g24h-crhwHigh· 7.5GitPython command wrappers omit unsafe protocol and option checks
GHSA-fx3j-rwgx-fr94Medium· 6.5GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
GHSA-gq48-pqfc-9p58MediumGitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree