Threats tagged 'brew-snakemake-cve-2026-110856'

Snakemake's use of GitPython contains a regex vulnerability in the parse_actor_and_date function that causes quadratic backtracking on malformed author/committer/tagger identity lines missing or having malformed trailing epoch or timezone data. This results in CPU exhaustion when processing crafted commit or tag objects with long malformed identity lines. The issue affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1 that modifies the regex to prevent backtracking.