Threats tagged 'brew-mistral-vibe-cve-2026-110856'

Mistral vibe's GitPython parse_actor_and_date() function has a regex vulnerability causing quadratic backtracking on malformed author/committer/tagger lines missing or having malformed trailing epoch or timezone data. This leads to CPU exhaustion when processing crafted commit or tag objects. The issue affects versions from 2.1.0 up to but not including 3.0.3. A patch fixing the regex to prevent backtracking is available in version 3.0.3. The vulnerability can cause significant delays (seconds per access) in applications using GitPython to read untrusted repositories.