CVE-2026-87819

GitPython before 3.1.60 contains a regular expression denial-of-service (ReDoS) flaw in Actor.name_email_regex, which parses commit author and committer fields. An attacker who can supply a crafted commit object—typically a commit pushed to or read from an untrusted repository with a malformed author line containing an unterminated angle bracket—triggers quadratic backtracking that consumes CPU for more than two minutes per commit access. The impact is availability only: parsing stalls and potential CPU resource exhaustion, with no confidentiality or integrity impact. Any deployment of an affected version that processes commits from untrusted or semi-trusted sources (CI pipelines, code search/indexing, repository viewers, git-based deployment tooling) is affected. As of publication there are no known in-the-wild exploits, no public proof-of-concept, and the flaw is not in CISA's KEV.

What to do: Upgrade to GitPython 3.1.60 or later. Until patched, restrict parsing of commit metadata to trusted repositories or apply timeouts/resource limits on processes reading third-party git history, and prioritize services that index or render untrusted repositories (CI, code search, hosting mirrors). The impact is availability-only (CVSS 8.7, VA:H), so patching urgency is highest for multi-tenant or internet-facing git-parsing services.