CVE-2026-110856 in GitPython
Summary
by MITRE • 10/15/2026
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
GitPython versions prior to 3.2.0 are susceptible to a regular expression denial of service vulnerability within the _re_actor_epoch pattern utilized by the parse_actor_and_date function. This component is responsible for parsing author, committer, and tagger lines in Git objects, which typically contain metadata such as names, email addresses, timestamps, and timezone offsets. The underlying issue stems from catastrophic backtracking inherent in the regular expression logic when processing malformed input data that lacks a valid epoch or timezone specification but contains extensive sequences of spaces.
The technical flaw manifests specifically when an attacker serves repositories containing commit or tag objects with long lines filled primarily with whitespace characters instead of standard date-time formats. The regex engine attempts to match these inputs against patterns designed for structured git metadata, leading to exponential time complexity due to overlapping alternatives and nested quantifiers in the pattern definition. This results in quadratic backtracking behavior where the processor spends excessive cycles exploring invalid paths before ultimately failing or timing out rather than quickly rejecting the malformed input as expected by secure coding practices.
From an operational perspective, this vulnerability allows remote attackers to cause CPU exhaustion on systems running vulnerable instances of GitPython without requiring authentication if they can influence the repository data being parsed. This could lead to service degradation for applications relying on git operations such as version control management tools, continuous integration pipelines, or automated deployment scripts that process untrusted repositories. The impact is particularly severe in environments where high-throughput parsing occurs since a single maliciously crafted object can consume significant computational resources over an extended period effectively creating a denial of service condition through resource starvation rather than traditional memory exhaustion techniques.
This vulnerability aligns with CWE-400 which classifies issues related to uncontrolled resource consumption and specifically highlights regular expression vulnerabilities that lead to excessive CPU usage during pattern matching operations. In the context of the MITRE ATT&CK framework this behavior corresponds to T1496 Resource Hijacking where adversaries leverage computational resources for disruptive purposes potentially impacting availability metrics across affected infrastructure components.
Mitigation strategies primarily involve upgrading GitPython to version 3.2.0 or later which addresses these regex inefficiencies through optimized pattern matching logic that prevents catastrophic backtracking scenarios. Organizations should also implement input validation and sanitization layers when processing external repository data especially in public-facing applications where untrusted sources may supply maliciously crafted git objects. Additionally deploying web application firewalls with rules capable of detecting anomalous CPU usage patterns associated with regex timeouts can provide an additional layer of defense against exploitation attempts targeting this specific weakness until patches are fully deployed across all affected systems.