CVE-2026-87819: Inefficient Regular Expression Complexity in gitpython-developers GitPython
Affects gitpython-developers GitPythonSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 43% of CVEs
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| gitpython-developersGitPython | Affected
| Fixed in
|
PyPIgitpythonpkg:pypi/gitpythonOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade GitPython to version 3.1.60 or later, where this vulnerability has been addressed. No other mitigation or workaround is indicated. Patch status is confirmed by the affectedVersions field indicating fixes in 3.1.60.
Description
GitPython versions before 3.1.60 contain a regular expression denial of service (ReDoS) vulnerability in the Actor.name_email_regex component that processes commit author and committer fields. An attacker can craft a commit object with a malformed author field containing an unterminated angle bracket, causing the regex to perform quadratic backtracking. This results in excessive CPU consumption, potentially exhausting resources for over two minutes per commit access.
Summary
CVE-2026-87819 describes a ReDoS vulnerability in GitPython prior to version 3.1.60. The vulnerability exists in the regular expression used to parse commit author and committer fields (Actor.name_email_regex). When processing a specially crafted commit object with a malformed author field containing an unterminated angle bracket, the regex engine experiences quadratic backtracking, leading to high CPU usage and denial of service conditions. This affects all versions before 3.1.60.
Impact
Successful exploitation can cause denial of service by exhausting CPU resources for extended periods (over two minutes) when accessing commits with maliciously crafted author fields. This can degrade system performance or cause service interruptions in environments using vulnerable GitPython versions.
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.