Inefficient regular expression complexity in GitPython - #VU145800
Published: August 26, 2026
Vulnerability identifier: #VU145800
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in Actor.name_email_regex in git/util.py when parsing the author or committer header of a git commit object containing a long string with an unterminated < character. A remote attacker can supply a specially crafted commit object to cause a denial of service.
The issue is triggered when GitPython resolves commit metadata such as .author or .committer from repositories or commit objects obtained from untrusted sources.
Affected software
GitPython
Remediation
Install security update from vendor's website.
GitPython - update to 3.1.60