ZeroDay Findings
Sign inSign up

Findings

CVE-2026-110856

GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

Published Oct 14, 2026 · updated Oct 15, 2026 · gitpython-developers GitPython

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

  2. Oct 15, 2026 · OSV.dev

    Updated

    GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

Affected

  • Debian:12 python-git3.1.30-1, 3.1.30-1+deb12u2, 3.1.36-1
  • Debian:13 python-git3.1.44-1, 3.1.45-1, 3.1.46-1
  • Debian:14 python-git3.1.44-1, 3.1.45-1, 3.1.46-1
  • vendor gitpython-developers GitPythonversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-110856

    GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-110856

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-110856

    GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines

    nvd.nist.gov
  • OSV.devPackage advisoryDEBIAN-CVE-2026-110856
    osv.dev

References