CVE-2026-87819 gitpython-developers CVE debrief

Who should care

Defenders responsible for GitPython applications, developers using GitPython, and security teams monitoring for potential denial of service attacks should be aware of this vulnerability and prioritize upgrading to GitPython 3.1.60 or later.

Why it matters

Defenders should care about CVE-2026-87819 because it affects GitPython before 3.1.60, allowing potential denial of service attacks through crafted commit objects. This vulnerability can exhaust CPU resources, impacting GitPython applications. Defenders should prioritize upgrading to GitPython 3.1.60 or later and monitor CPU resource usage.

• Potential denial of service attacks through crafted commit objects
• CPU resource exhaustion for over two minutes per commit access
• Need for verification of affected versions and exploitation

Technical summary

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access. This vulnerability affects GitPython applications and can be mitigated by upgrading to GitPython 3.1.60 or later. Defenders should review commit objects for potential malformed author fields and monitor CPU resource usage for GitPython applications.

Defensive priority

Defenders should prioritize upgrading to GitPython 3.1.60 or later to prevent potential denial of service attacks.

Recommended defensive actions

• Upgrade to GitPython 3.1.60 or later
• Review commit objects for potential malformed author fields
• Monitor CPU resource usage for GitPython applications
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify any known exploitation or affected versions beyond GitPython before 3.1.60. The vulnerability is caused by a regular expression denial of service in Actor.name_email_regex. Defenders should verify affected versions, review commit objects, and monitor CPU resource usage. The CVE Program record and NVD detail page offer source-provided metadata and vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.