28 matches found
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...
8.7CVSS7.5AI score0.00521EPSS
SaveExploits1References5Affected Software1
20