GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines

影響: pip:GitPython <= 3.1.62 → 3.2.0

This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone is missing or malformed, so the same class of slow parse is still reachable in 3.1.62. Details git/objects/util.py:322: python _re_actor_epoch = re.compile(r"^.+? (.) (\d+) ([+-]\d+).$") .+? and (.) can…

Read on GitHub Advisory Database

On 10/28/2026, 12:26 AM, GitHub Advisory Database published "GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines" (type: Advisory). Severity is "High" (high). Related technologies: Python.