CVE-2026-87819

GitPython before 3.1.60 Denial of Service via ReDoS

No known exploitation. EPSS puts it in the 42nd percentile. Only a workaround so far.

CVSS 3.17.5High EPSS percentile42nd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2026-09-09Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Steps

Written by AI from the record

Check whether your applications use GitPython and whether the installed version is earlier than 3.1.60.
Upgrade GitPython to version 3.1.60.
Until upgraded, prevent untrusted repositories or commits from being processed by affected applications.

pip install --upgrade GitPython==3.1.60

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

In plain language

Written by AI from the record

GitPython versions before 3.1.60 can be made to stall when processing a malicious Git commit, so small businesses should act if their software reads repositories or commits from outside sources.

Unauthenticated ReDoS in GitPython’s Actor.name_email_regex allows a malformed commit author or committer field with an unterminated angle bracket to trigger quadratic regex backtracking and CPU exhaustion.

If you're affected

Application becomes unresponsive
High CPU usage
Delayed developer workflows
Service disruption

What is it

This is a flaw in how GitPython reads the name information attached to a Git commit. A maliciously formed commit can make the application spend a long time trying to interpret that information, like a receptionist stuck repeatedly trying to decipher one deliberately confusing form while everyone else waits.

Who is affected

This matters to you if your application uses GitPython to inspect Git repositories or commit history. The risk exists when that application processes commits that an attacker can influence, such as content from an external repository.

How urgent is it

An attacker must get a specially malformed commit processed by your application to trigger the slowdown. There is no known public exploit code and no reported active exploitation, but upgrade in your normal near-term maintenance window if you process outside Git content.

What to do — in detail

Confirm the installed GitPython version in each deployed Python environment and identify applications that call GitPython to inspect commits, especially repositories supplied by customers, contributors, or other external parties.

Upgrade affected deployments to GitPython 3.1.60. Validate the upgrade in a test environment, then deploy it through the normal release process; the findings do not identify a breaking-change requirement.

If patching is delayed, restrict affected applications from processing untrusted repositories or commits and review the vendor advisory for its workaround guidance: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx

No CISA KEV remediation due date applies because this CVE is not listed in CISA KEV. Monitor application response times and CPU consumption when repository or commit processing occurs, and investigate sustained spikes or stalled jobs.

Technical context

CVE-2026-87819 is rated CVSS 7.5 (High): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is CWE-1333, a regular-expression denial-of-service issue in Actor.name_email_regex. A crafted commit author or committer field containing an unterminated angle bracket can cause quadratic backtracking; the supplied description reports more than two minutes of CPU use per commit access. It is not in CISA KEV, no public exploit code is on record, and EPSS is 0.3% (22th percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS42nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 42nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 9 days, from the signal feeds we watch.

2026-09-18OpenVAS check addedworkaround available, record updated
2026-09-16Workaround availablerecord updated
2026-09-09Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

gitpython projectoss-projectaka gitpython
- gitpythonLibraryOSS Libraries / pypi
gitpython-developerspackage-ecosystem
- GitPythonMixedDevTools & CI / source-control

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable