3 matches found
GHSA-M64X-33Q8-M5H7 GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
Summary This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor.fromstring regex-free, but parseactoranddate still runs reactorepoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone i...
Regular Expression Denial of Service (ReDoS)
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the reactorepoch pattern in parseactoranddate git/objects/util.py. The pattern ^.+? . \d+ +-\d+.$ allows .+? and . to bo...