CVE-2026-110856: Inefficient Regular Expression Complexity in gitpython-developers GitPython

CVE-2026-110856 describes a ReDoS vulnerability in GitPython prior to version 3.2.0. The vulnerability exists in the _re_actor_epoch regular expression pattern used by the parse_actor_and_date function when processing author, committer, and tagger lines in commit or tag objects. Maliciously crafted repository data containing long space-filled lines without valid epoch or timezone information can cause the regex engine to perform quadratic backtracking, leading to denial of service via CPU resource exhaustion.

Successful exploitation can cause denial of service by exhausting CPU resources on systems processing malicious Git repositories. This can disrupt normal operations of applications or services relying on GitPython to parse repository metadata. There is no indication of privilege escalation, data leakage, or other impacts beyond CPU exhaustion.

Upgrade GitPython to version 3.2.0 or later where this vulnerability is fixed. No other mitigations or temporary workarounds are indicated. Since this is a library vulnerability, users should ensure dependent applications update their GitPython dependency accordingly.