Executive brief
GitPython is a Python library that developers and CI systems use to programmatically read and manipulate Git repositories. A malformed commit object with an unterminated angle bracket in the author field can trigger excessive CPU consumption (up to 2+ minutes per operation) when GitPython parses the author or committer metadata. An attacker can exploit this by injecting a crafted commit into a repository to cause denial of service against any service that processes commits, including CI/CD pipelines and code repositories.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the Actor.name_email_regex pattern (git/util.py, line 863): `(.*) <(.*?)>`. The unbounded greedy group (.*) followed by a literal space and < causes quadratic backtracking when the regex engine processes an author field with a long string and unterminated angle bracket. The regex is evaluated every time GitPython accesses commit.author or commit.committer properties, with no length limits or timeout applied. Empirical testing shows O(n²) performance degradation: a 200,000-byte malformed author field takes ~150 seconds to process. The attack vector is network-reachable (crafted commits can be pushed to repositories with lax fsck settings or delivered as archives), and no authentication is required if the attacker can influence the commit data. The vulnerability was patched in version 3.1.60; prior versions through 3.1.59 are affected.
Affected products
- GitPython developers GitPython before 3.1.60
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory (GHSA-g5vv-9gxw-82hx) published
- 2026-09-09: advisory: CVE-2026-87819 published on NVD
- 2026: patched: Fixed in GitPython 3.1.60 and later