GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

Advisories

GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

Severity: high
Date: 10/14/2026
Affecting: GitPython >= 0, < 3.2.0
CVE: CVE-2026-110856
CWE: CWE-1333 Inefficient Regular Expression Complexity
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-m64x-33q8-m5h7)
Credit: BrianWillows
Description: GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo