Regular Expression Denial of Service in GitPython Affects Repository Performances

CVE-2026-110856

What is CVE-2026-110856?

GitPython version prior to 3.2.0 is susceptible to a regular expression denial of service vulnerability. This issue arises from the _re_actor_epoch pattern used in the parse_actor_and_date function applied on author, committer, and tagger lines. Attackers can exploit this flaw by submitting carefully crafted commit or tag objects, which consist of excessively long lines filled with spaces and lacking a valid epoch or timezone. This causes inefficient processing, leading to quadratic backtracking and significant CPU exhaustion, degrading performance and potentially disrupting service.

References