GitPython regular expression denial of service in Actor.name_email_regex

Severity: high · CVSS 7.5 · Published 2026-09-09

GitPython is a library that developers use to interact with Git repositories programmatically. A flaw in how it parses commit author and committer fields allows an attacker to craft a malicious commit that causes the library to consume CPU resources for several minutes, disrupting any service that reads commit metadata. This could affect CI/CD pipelines, code hosting platforms, and repository scanning tools.

Technologies: GitPython Developers GitPython, gitpython (PyPI). Vendors: GitPython Developers, PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 9 September 2026.
Which products and versions are affected?
GitPython Developers GitPython before 3.1.60; gitpython (PyPI) <= 3.1.59.
Is there a fix for This vulnerability?
A patch was published on 2026-09-09: Fix available in GitPython 3.1.60 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run GitPython Developers GitPython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GitPython's Actor.name_email_regex (git/util.py line 863) uses an unbounded greedy regex pattern (.*) &lt;(.*?)&gt; that exhibits quadratic backtracking when processing author/committer fields containing an unterminated angle bracket. The vulnerability is triggered whenever commit.author, commit.committer, repo.iter_commits(), or repo.blame() is accessed on a crafted commit object, with no length limits or timeouts applied before regex execution. The fix was released in GitPython 3.1.60.

Affected products

  • GitPython Developers GitPython before 3.1.60

Timeline

  • 2026-08-26: disclosed: Advisory GHSA-g5vv-9gxw-82hx published
  • 2026-09-09: advisory: Duplicate advisory GHSA-qpf5-3wfw-fh7q published and later withdrawn
  • 2026-09-09: patched: Fix available in GitPython 3.1.60 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.