CVE-2026-87819: Gitpython Project Gitpython

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

Affected products

• Gitpython Project Gitpython: before 3.1.60 (fixed in 3.1.60)

Published 2026-09-09. Last modified 2026-09-18.