CVE-2026-110856

7.5High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-1333

Impact

Remote attackers can cause denial of service via CPU exhaustion on services parsing untrusted repositories. They just need the application to process a repository containing specially crafted commit or tag objects.

Root cause

The _re_actor_epoch regular expression in parse_actor_and_date suffers from catastrophic backtracking when matching long space-filled lines missing an epoch or timezone.

Affected systems

GitPython before 3.2.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade GitPython to version 3.2.0 or newer. If you cannot upgrade immediately, avoid parsing commits or tags from untrusted Git repositories.

shell

$ pip install --upgrade 'GitPython>=3.2.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110856