CVE-2026-87819— GitPython before 3.1.60 Denial of Service via ReDoS
Quick assessment
Affected
gitpython-developers GitPython
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GitPython 3.1.60 之前版本中， 正则表达式存在拒绝服务漏洞，该正则用于处理提交作者（author）和提交者（committer）字段。攻击者可以构造一个包含未闭合尖括号的畸形作者字段，从而引发二次回溯（quadratic backtracking），导致每次访问提交时 CPU 资源被消耗超过两分钟。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87819
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GitPython before 3.1.60 Denial of Service via ReDoS
Source: CVE Program / CVE List V5
Vulnerability Description
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| gitpython-developers | GitPython | 0 ~ 3.1.60 | - |
|
II. Public POCs for CVE-2026-87819
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87819
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-87819 (2)
-
-
🔗 GitPython before 3.1.60 Denial of Service via ReDoS | Advisories | VulnCheck third-party-advisory
Same Patch Batch · gitpython-developers · 2026-09-09 · 3 CVEs total
| CVE-2026-87817 | 8.8 HIGH | GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation |
| CVE-2026-87818 | 6.5 MEDIUM | GitPython 3.1.59 Local File Content Oracle via --no-index |
IV. Related Vulnerabilities
Same product: GitPython
-
CVE-2026-87818
GitPython 3.1.59 Local File Content Oracle via --no-index -
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Direct -
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference -
CVE-2026-78678
GitPython before 3.1.59 Arbitrary File Read via Repo.blame() -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir
Same vendor: gitpython-developers
-
CVE-2026-87818
GitPython 3.1.59 Local File Content Oracle via --no-index -
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Direct -
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference -
CVE-2026-78678
GitPython before 3.1.59 Arbitrary File Read via Repo.blame() -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir
Same weakness: CWE-1333
-
CVE-2026-86081
n8n: Regular Expression Denial of Service in the Default Blo -
CVE-2026-85062
Colord: Slow rejection of oversized malformed color strings -
CVE-2024-58379
nodemailer before 6.9.9 ReDoS via attachDataUrls parameter -
CVE-2026-80206
NLTK 3.10.2 Regular Expression Denial of Service via tgrep -
CVE-2026-80205
NLTK before 3.10.0 ReDoS via Text.findall() unvalidated rege
V. Comments for CVE-2026-87819
No comments yet