CVE-2026-87819 Overview
CVE-2026-87819 is a regular expression denial of service (ReDoS) vulnerability in GitPython versions before 3.1.60. The flaw resides in the Actor.name_email_regex pattern that parses author and committer fields from Git commit objects. An attacker who supplies a crafted commit with a malformed author field, such as one containing an unterminated angle bracket, triggers quadratic backtracking in the regex engine. Each affected commit access consumes CPU resources for over two minutes, blocking application threads that rely on GitPython for repository introspection.
Critical Impact
A single malicious commit can stall any GitPython-based service for minutes per access, enabling remote CPU exhaustion against CI/CD pipelines, code analysis tools, and Git automation platforms.
Affected Products
- GitPython versions prior to 3.1.60
- Python applications that parse untrusted Git repositories using GitPython
- CI/CD, code review, and automation platforms embedding GitPython
Discovery Timeline
- 2026-09-09 - CVE-2026-87819 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87819
Vulnerability Analysis
GitPython exposes commit metadata through the Actor class, which parses raw author and committer strings into name and email components. The parser uses Actor.name_email_regex, a regular expression with overlapping quantifiers that becomes catastrophically expensive on inputs that never match the terminal anchor. When an author string contains an opening angle bracket without a matching close bracket, the regex engine explores an exponential number of backtracking paths relative to the length of the input. This maps to [CWE-1333], inefficient regular expression complexity.
Exploitation requires only that a target application read a commit object containing the malicious field. The vulnerability does not compromise confidentiality or integrity, but it exhausts CPU and blocks the calling thread for extended periods.
Root Cause
The root cause is an ambiguous pattern in Actor.name_email_regex that permits quadratic backtracking on inputs lacking the expected terminating character. Attacker-controlled repetition combined with a missing anchor produces worst-case matching behavior on adversarial input.
Attack Vector
An attacker crafts a Git commit with a malformed author or committer field, for example a name containing an unterminated < character, and publishes the commit to a repository the target application processes. When downstream tooling calls into GitPython to access the commit's author or committer attribute, the regex triggers, and the process hangs for over two minutes per access. Repeated access or many crafted commits produce sustained denial of service.
No verified public exploit code is available. See the GitHub Security Advisory and the VulnCheck Advisory for GitPython for additional technical detail.
Detection Methods for CVE-2026-87819
Indicators of Compromise
- Python processes consuming 100% CPU on a single core for two or more minutes while executing GitPython call stacks.
- Repository commits containing author or committer fields with unterminated < characters or otherwise malformed email delimiters.
- CI/CD job timeouts or worker starvation coinciding with processing of untrusted pull requests or forks.
Detection Strategies
- Inventory Python environments for installed GitPython versions and flag any release below 3.1.60.
- Instrument GitPython callers with per-operation timeouts and log stack traces of long-running Actor parsing calls.
- Scan incoming repositories and commits for malformed author or committer headers before invoking GitPython APIs.
Monitoring Recommendations
- Track CPU utilization and wall-clock duration of Git parsing tasks in CI/CD runners and code intelligence services.
- Alert on repeated timeouts of jobs that read commit metadata from external or untrusted repositories.
- Correlate worker thread hangs with the specific commit SHAs being processed to identify malicious source material.
How to Mitigate CVE-2026-87819
Immediate Actions Required
- Upgrade GitPython to version 3.1.60 or later across all Python environments and container images.
- Audit build pipelines, static analysis tools, and internal automation for transitive GitPython dependencies and pin the fixed version.
- Apply timeouts and CPU quotas to processes that parse commits from untrusted repositories.
Patch Information
The GitPython maintainers addressed the ReDoS in version 3.1.60 by hardening Actor.name_email_regex against quadratic backtracking. Refer to the GitHub Security Advisory for the patch commit and release notes.
Workarounds
- Validate and reject commit author or committer fields containing unbalanced angle brackets before invoking GitPython.
- Execute GitPython operations inside subprocesses with strict CPU and wall-clock limits so that a hang can be terminated.
- Restrict Git ingestion services to trusted sources until the upgrade to 3.1.60 is deployed.
# Upgrade GitPython to the fixed release
pip install --upgrade 'GitPython>=3.1.60'
# Verify the installed version
python -c "import git; print(git.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
