Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

GitPython can hang processing crafted commit author

published 1 month ago

Summary

GitPython versions before 3.1.60 may become extremely slow when reading a commit that contains a specially crafted author field. This slowdown can tie up server CPU for minutes, affecting any system that processes Git commits with this library. Upgrade GitPython to version 3.1.60 or later to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
pip	sebastian thiel	gitpython	<= 3.1.59

Original advisory text

Duplicate Advisory: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-g5vv-9gxw-82hx. This link is maintained to preserve external references.

## Original Description
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

8.7 High

Type

CWE-1333Inefficient Regular Expression Complexity (ReDoS)

Timeline

Published9 Sep 2026

Updated30 Sep 2026

First seen30 Sep 2026

Sources

GHSA-qpf5-3wfw-fh7q · GHSA

Track software like this

Free during beta