CVE-2026-87819 — GitPython before 3.1.60 Denial of Service via ReDoS
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can …
Published: 2026-09-09 · CVSS: 8.7 · CVSS 4.0
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7