CVE-2026-87819: GitPython ReDoS via catastrophic backtracking in Actor.name_email_regex

CVE-2026-87819 · Severity: high · CVSS 7.5 · Published 2026-09-09

GitPython is a Python library that developers and CI systems use to programmatically read and manipulate Git repositories. A malformed commit object with an unterminated angle bracket in the author field can trigger excessive CPU consumption (up to 2+ minutes per operation) when GitPython parses the author or committer metadata. An attacker can exploit this by injecting a crafted commit into a repository to cause denial of service against any service that processes commits, including CI/CD pipelines and code repositories.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-87819 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-87819 being exploited in the wild.
How severe is CVE-2026-87819?
High severity, with a CVSS score of 7.5, published 9 September 2026.
Which products and versions are affected?
gitpython (PyPI) <= 3.1.59, ECOSYSTEM:introduced=0,fixed=3.1.60.
Is there a fix for CVE-2026-87819?
Yes. gitpython (PyPI): upgrade to 3.1.60 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87819 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-87819?
Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gitpython (PyPI): upgrade to 3.1.60 or later
    pip install "gitpython>=3.1.60"

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the Actor.name_email_regex pattern (git/util.py, line 863): `(.*) <(.*?)>`. The unbounded greedy group (.*) followed by a literal space and &lt; causes quadratic backtracking when the regex engine processes an author field with a long string and unterminated angle bracket. The regex is evaluated every time GitPython accesses commit.author or commit.committer properties, with no length limits or timeout applied. Empirical testing shows O(n²) performance degradation: a 200,000-byte malformed author field takes ~150 seconds to process. The attack vector is network-reachable (crafted commits can be pushed to repositories with lax fsck settings or delivered as archives), and no authentication is required if the attacker can influence the commit data. The vulnerability was patched in version 3.1.60; prior versions through 3.1.59 are affected.

Affected products

  • GitPython developers GitPython before 3.1.60

Identifiers

  • CVE-2026-87819
  • GHSA-g5vv-9gxw-82hx
  • PYSEC-2026-3984

Timeline

  • 2026-08-26: disclosed: GitHub Security Advisory (GHSA-g5vv-9gxw-82hx) published
  • 2026-09-09: advisory: CVE-2026-87819 published on NVD
  • 2026: patched: Fixed in GitPython 3.1.60 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.