26 matches found
GHSA-M64X-33Q8-M5H7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...
8.7CVSS7.4AI score0.00337EPSS
SaveExploits0References5
20