HIGH7.5

PYSEC-2026-3984

Quick fix

PYSEC-2026-3984 — gitpython: upgrade to the fixed version with the command below.

pip install --upgrade 'gitpython>=3.1.60'

Details

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/gitpython

Introduced in: 0Fixed in: 3.1.60

Fixpip install --upgrade 'gitpython>=3.1.60'

References

https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos[ADVISORY]
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx[EVIDENCE]