CVE-2026-87819 in GitPython
Summary
by MITRE • 09/09/2026
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The security flaw identified as CVE-2024-37891 resides within the GitPython library prior to version 3.1.60 and specifically affects the Actor.name_email_regex regular expression engine used during the parsing of git commit objects. This vulnerability is classified under CWE-400, which denotes uncontrolled resource consumption due to a Regular Expression Denial of Service or ReDoS attack vector. The core technical issue stems from the design of the regex pattern intended to extract author and committer email addresses from commit metadata. When processing these fields, the library relies on complex grouping constructs that are susceptible to catastrophic backtracking when presented with specially crafted input strings containing unterminated angle brackets or other malformed sequences.
In a normal operational scenario, GitPython parses git log output or individual commits to provide Pythonic access to repository data. However, an attacker who can influence the content of these commit fields, such as through a maliciously created pull request or by manipulating local repository history in a shared environment, can trigger this flaw. The malformed author field containing specific patterns causes the regex engine to enter a state of exponential time complexity relative to the length of the input string. This results in quadratic backtracking behavior where the processor attempts numerous invalid combinations before failing to match, effectively freezing the thread or process for an extended period.
The operational impact of this vulnerability is significant within environments that rely on GitPython for automated code review systems, continuous integration pipelines, or repository management tools. An attacker can exploit this flaw to cause a denial of service by exhausting CPU resources. The documentation indicates that processing a single malicious commit object can consume processor time for over two minutes. In high-throughput scenarios where multiple commits are processed concurrently, such as during large merges or bulk operations in CI/CD pipelines, this can lead to complete system unresponsiveness, resource starvation for other critical services, and potential cascading failures across the infrastructure dependent on these git parsing functions.
Mitigation strategies primarily involve upgrading GitPython to version 3.1.60 or later, where the regular expression has been optimized to prevent catastrophic backtracking by simplifying the pattern structure and removing ambiguous quantifiers that allow for exponential path exploration. For organizations unable to immediately upgrade, defensive coding practices should be implemented within applications using older versions of the library. This includes implementing strict input validation on commit metadata before passing it to GitPython parsing functions, setting timeouts or resource limits around regex execution if supported by the hosting environment, and avoiding direct processing of untrusted git log outputs without sanitization. Additionally, monitoring for unusually high CPU usage spikes correlated with git operations can serve as an early detection mechanism for active exploitation attempts in production environments.