Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-87819 high CVSS 7.5

Vulnerability in GitPython (CVE-2026-87819)

Summary

Vulnerability in GitPython (CVE-2026-87819). Risk of unauthorized operations or information disclosure. Exploitable via Actor.name_email_regex. Mitigation: upgrade to 3.1.60 or later.

Original description

The description as published by the source.

Summary

GitPython's Actor.name_email_regex regular expression (git/util.py, line 863)
is vulnerable to catastrophic backtracking (ReDoS — Regular Expression Denial of
Service). When GitPython parses the author or committer header of a git commit
object that contains a long string with an unterminated < (no matching >), the
Python regex engine enters quadratic backtracking, causing complete single-threaded
CPU exhaustion proportional to the square of the input length.

A single crafted commit object can block any GitPython API call that reads
.author or .committer for over two minutes per invocation, enabling denial
of service against CI runners, code-hosting backends, repository-scanning
pipelines, or any service that processes commits from third-party or untrusted
repositories.

Details

Vulnerable file and line:

git/util.py, line 863:

name_email_regex = re.compile(r"(.*) <(.*?)>")

This regex is evaluated inside Actor._from_string() (line 909) every time
GitPython resolves a commit's .author or .committer property.

Full call chain — from public API to vulnerable sink:

commit.author # any ordinary GitPython API call
└── git/objects/commit.py:917
Commit._deserialize()
└── git/objects/util.py:341
parse_actor_and_date(author_line)
└── git/util.py:909
Actor._from_string(string)
└── Actor.name_email_regex.search(string) ← VULNERABLE

author_line is decoded directly from the raw bytes of the git commit object wi…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-87819 has been found in GitPython.
Attackers can target a specific entry point like Actor.name_email_regex over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade GitPython to 3.1.60 or later.
If unsure, ask your IT team or search "GitPython CVE-2026-87819" on the vendor's site.

CVE-2026-87819 (GitPython) — CWE-400 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: Actor.name_email_regex / author / committer / author_line
Patched: 3.1.60 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-400) exists in GitPython. Attackers reach the vulnerable code path via Actor.name_email_regex without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of GitPython. Attack surface: Actor.name_email_regex / author / committer / author_line.

🔥 Severity

Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 3.1.60.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'GitPython' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'GitPython' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で GitPython を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade GitPython to 3.1.60

    ステージング環境で 3.1.60 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip GitPython
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.60"}]}]
PyPI gitpython
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.60"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details