CVE-2026-87819: GitPython before 3.1.60 Denial of Service via ReDoS

Q: Who is exposed to this denial-of-service condition?

Applications using GitPython before 3.1.60 are exposed when they access commit author or committer fields from a crafted commit object. The issue can consume CPU for more than two minutes for each affected commit access.

Q: What does an attacker need to exploit the issue?

An attacker needs to provide or cause the application to process a commit object whose author field contains a malformed, unterminated angle bracket. No authentication or user interaction is required according to the supplied severity vector.

Q: What is the remediation?

Upgrade GitPython to version 3.1.60 or later. The affected versions are those before 3.1.60.

Published Sep 9, 2026

Updated

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.nameemailregex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

Affected Software

1 affected component

GitPython GitPython<3.1.60

Event History

Sep 9, 2026

CVE Published

via MITRE·11:21 AM

Data Sourced

via MITRE·11:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service condition?

Applications using GitPython before 3.1.60 are exposed when they access commit author or committer fields from a crafted commit object. The issue can consume CPU for more than two minutes for each affected commit access.

What does an attacker need to exploit the issue?

An attacker needs to provide or cause the application to process a commit object whose author field contains a malformed, unterminated angle bracket. No authentication or user interaction is required according to the supplied severity vector.

What is the remediation?