CVE-2026-110856: GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using GitPython before 3.2.0 are exposed when they parse commit or tag objects from repositories that may be attacker-controlled or otherwise untrusted.
What does an attacker need to do to trigger the denial of service?
An attacker needs to serve a repository containing commit or tag objects with long space-filled author, committer, or tagger lines that omit a valid epoch or timezone. Processing those objects can cause quadratic regular-expression backtracking and exhaust CPU.
Is authentication or user interaction required?
No. The supplied severity vector indicates network attack access with low complexity, no privileges required, and no user interaction required.
What is the remediation?
Upgrade GitPython to version 3.2.0 or later. The affected versions are those before 3.2.0.