GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines

影響: pip:GitPython <= 3.1.62 → 3.2.0

This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone is missing or malformed, so the same class of slow parse is still reachable in 3.1.62. Details git/objects/util.py:322: python _re_actor_epoch = re.compile(r"^.+? (.) (\d+) ([+-]\d+).$") .+? and (.) can…

在 GitHub Advisory Database 阅读

2026/10/28 00:26，GitHub Advisory Database 发布了“GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。