HighVulnerabilityGHSA-m64x-33q8-m5h7updated 27 Oct 2026, 15:26 UTC

GitPython can freeze when reading a crafted Git commit or tag

A specially crafted commit or tag in a Git repository can make a program using GitPython take many seconds to read it, using up the computer's processing time. Anyone who scans or reads untrusted repositories with such a tool can have it sl

Fixed in GitPython 3.2.0Official source

Severity	HighCVSS 8.7 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	YesGitPython 3.2.0 · since 27 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Attacker crafts commitAuthor line has no valid epoch or timezone
2Malicious repo pushedGit objects are accepted without strict checks
3Tool reads commitGitPython parses author or tagger line
4CPU spikesRegex backtracks quadratically, taking seconds
ResultTool is slowed or stalled by CPU exhaustion

What happened

A regular expression (_re_actor_epoch in git/objects/util.py) backtracks quadratically when the author, committer or tagger line lacks a valid epoch and timezone, causing CPU exhaustion (CWE-1333). It is a residual of CVE-2026-87819 that the 3.1.60 fix did not fully address.

Why it is dangerous: Tools that read commits or tags from untrusted repositories, such as CI systems, repository scanners and code-hosting integrations, can have their CPU exhausted. Each access to Commit.author, Commit.committer or TagObject.tagger on a crafted object can cost seconds.

Are you affected?

You are affected if you use GitPython 3.1.62 or earlier to read commits or tags from repositories you do not fully trust.

Package / product	Affected versions	Fixed in
GitPython · pip	<= 3.1.62	3.2.0

What to do

Upgrade GitPython to 3.2.0 or later (pip install --upgrade GitPython)
Until you upgrade, avoid reading commits or tags from untrusted repositories with GitPython
Check that your tools do not run with time or resource limits removed when processing untrusted repositories

Timeline

27 Oct 2026, 15:26 UTC
Publicly disclosed
27 Oct 2026, 15:26 UTC
Reported by GitHub Advisory · GitHub Advisory
27 Oct 2026, 15:26 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity linesGitHub Advisory · 27 Oct 2026, 15:26 UTC

Technical details

ID: GHSA-m64x-33q8-m5h7
CVSS: 8.7 / 10
Disclosed: 27 Oct 2026, 15:26 UTC
On Zero Radar: 27 Oct 2026, 15:26 UTC (0 min after disclosure)
Last change: 27 Oct 2026, 15:26 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works