Advisory · CVE-2026-110856
GitPython parsing flaw lets crafted repositories exhaust CPU
GitPython before 3.2.0 has a regular expression denial of service in actor and date parsing that crafted commit or tag objects can trigger. CVSS 4.0 8.7.
- Vendor
- GitPython
- Product
- GitPython
- Identifier / CWE
- CVE-2026-110856
CWE-1333 - Action timing
- Immediate
Explain it like I’m five
A specially written name tag makes the reader keep re-reading the same line until the worker stalls.
- 01Crafted repository served
An attacker serves a repository with commit or tag objects containing long space-filled lines.
- 02Actor data parsed
GitPython parses author, committer, or tagger lines with the affected pattern.
- 03Backtracking grows
Lines lacking a valid epoch or timezone cause quadratic backtracking in the pattern.
- 04CPU exhausted
The calling process spends excessive CPU and availability drops.
What happened
The GitHub advisory for GitPython describes a regular expression denial of service before 3.2.0 in the pattern used when parsing actor and date information from author, committer, and tagger lines.
Repositories containing long space-filled lines without a valid epoch or timezone can cause quadratic backtracking and CPU exhaustion in applications that parse them.
What to do
- Inventory services and jobs that use GitPython to clone or inspect untrusted repositories.
- Upgrade GitPython to 3.2.0 or later using the project advisory guidance.
- Apply time and resource limits to repository parsing jobs until the upgrade is complete.
- Review worker logs for parsing jobs with abnormal CPU use or timeouts on specific repositories.
- Verify the deployed library version in each environment after patching.
Management note
This is an availability flaw in a library that often runs inside automation. Resource limits buy time, but the fix is the upgrade, especially for services that ingest outside repositories.