CVE-2026-87819
Description
A flaw was found in GitPython. A remote attacker could exploit a regular expression denial of service (ReDoS) vulnerability by crafting a malicious commit object. Specifically, a malformed author field containing an unterminated angle bracket can cause excessive processing, leading to the exhaustion of CPU resources and a denial of service for over two minutes per commit access.
Statement
A regular expression denial of service vulnerability was found in GitPython when processing commit author and committer fields. The Actor.name_email_regex pattern exhibits quadratic backtracking when encountering malformed author fields containing unterminated angle brackets. An attacker who can introduce a crafted commit object into a repository that is subsequently processed by a GitPython application can cause excessive CPU resource consumption, leading to denial of service for over two minutes per commit access. This requires the application to parse commits from untrusted sources such as public git servers, tarballs, or automated import tools.
Mitigation
Update GitPython to version 3.1.60 or later. Validate and sanitize git repository sources before processing. Enable git fsck validation (receive.fsckObjects) on git servers to reject malformed commit objects. Implement length limits on commit metadata fields before processing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
