CVE-2026-110856

Awaiting Analysis Awaiting Analysis - Queue

GitPython Regex DoS in parse_actor_and_date

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110856

EUVD

EUVD-2026-101739

Affected Vendors & Products

Vendor	Product	Version / Range
gitpython-developers	GitPython	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

GitPython before 3.2.0 has a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date. Attackers can exploit this by creating repositories with commit or tag objects containing long space-filled lines without a valid epoch or timezone, causing CPU exhaustion through quadratic backtracking.

Detection Guidance

To detect this vulnerability, check if your system uses GitPython versions before 3.2.0. Run: pip show GitPython. If installed, verify the version. If vulnerable, update to version 3.2.0 or later immediately.

Impact Analysis

This vulnerability can lead to denial of service by consuming excessive CPU resources, potentially slowing down or crashing systems processing affected Git repositories. It may disrupt development workflows, CI/CD pipelines, or any automated systems relying on GitPython for parsing Git objects.

Compliance Impact

This vulnerability causes CPU exhaustion through quadratic backtracking in GitPython's parsing of commit or tag objects, which could lead to denial of service. For compliance standards like GDPR or HIPAA, such disruptions may impact availability of systems processing personal or health data, potentially violating requirements for timely access or processing.

Mitigation Strategies

Upgrade GitPython to version 3.2.0 or later to address the ReDoS vulnerability in the _re_actor_epoch pattern.

Hi! I’m here to help you understand CVE-2026-110856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70