CVE-2026-87819 is a ReDoS vulnerability in GitPython prior to version 3.1.60. The flaw exists in the regular expression used to parse commit author and committer fields (Actor.name_email_regex). An attacker can exploit this by crafting a commit object with a malformed author field containing an unterminated angle bracket, triggering quadratic backtracking in the regex engine. This results in significant CPU resource exhaustion, potentially causing denial of service conditions when accessing affected commits.

Successful exploitation leads to denial of service by exhausting CPU resources for extended periods (over two minutes) per commit access. This can degrade system performance or cause unavailability of GitPython operations that parse commit metadata. There is no indication of privilege escalation, data disclosure, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the gitpython-developers project for updates addressing this vulnerability. Until a fix is available, avoid processing untrusted commit objects or implement resource limits to mitigate potential CPU exhaustion.