GitPython EUVD-2026-101739

Exploitation requires that a victim application using GitPython before 3.2.0 parse Git commit or tag objects originating from an attacker-controlled repository - specifically, the code path reaching parse_actor_and_date on author, committer, or tagger lines. The malicious trigger is a line padded with long space-filled sequences that lacks a valid epoch/timezone, driving the _re_actor_epoch regex into quadratic backtracking. The limiting factor is attacker control over repository content that the victim actually ingests: the risk is realized only where GitPython processes untrusted or remote repositories (e.g. CI pipelines, repo-hosting, mirroring, or analysis services), and is minimal where it operates solely on trusted local repositories.

This is a regular-expression denial-of-service (CWE-1333) flaw with a network attack vector and no authentication or user privileges required (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), but its impact is strictly availability (VA:H; VC:N/VI:N) - there is no confidentiality or integrity exposure, so despite the 8.7 'High' score this is CPU exhaustion only, not code execution or data compromise. The provided vector shows UI:N, yet exploitation realistically depends on a victim application fetching or parsing an attacker-served repository, so the true remoteness hinges on whether that parsing is automated (e.g. CI, hosting, mirroring services) versus a manual clone - verify against the actual deployment. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active exploitation or widespread weaponization; the signals point to a plausible but not-yet-prioritized DoS rather than an urgent threat. Treat as a service-availability hardening item: patch where GitPython processes untrusted repositories, deprioritize where it only touches trusted/local repos.

An attacker publishes or serves a malicious Git repository containing commit or tag objects whose author/committer/tagger lines are padded with long runs of spaces and omit a valid epoch and timezone. When a victim service running GitPython before 3.2.0 clones or parses that repository and invokes parse_actor_and_date, the vulnerable _re_actor_epoch pattern triggers quadratic backtracking, pinning a CPU core and stalling the process. No public exploit code was identified at time of analysis, though the malicious input is trivial to craft from the description.