CVE-2026-110856

Executive Summary

CVE-2026-110856 is a regular expression denial of service (ReDoS) vulnerability in GitPython versions before 3.2.0, affecting the _re_actor_epoch pattern used by the parse_actor_and_date function when processing author, committer, and tagger metadata lines in Git commit and tag objects. Any application that uses GitPython to parse untrusted Git repositories — including CI/CD pipeline automation, code review tooling, dependency scanners, and repository analysis platforms — is affected. Successful exploitation causes quadratic regex backtracking that exhausts CPU resources, resulting in availability loss (CVSS 7.5, C:N/I:N/A:H) with no confidentiality or integrity impact.

Technical Analysis

The vulnerability resides in GitPython's parsing logic for Git object metadata. Git commits and tags carry an actor line that conventionally includes a name, email, timestamp, and timezone, for example author Name <email> 1700000000 +0000. GitPython's parse_actor_and_date function applies the compiled regular expression _re_actor_epoch to these lines to separate the actor identity from the epoch and timezone fields.

The pattern is vulnerable to catastrophic (quadratic) backtracking. When a crafted line contains a long run of space characters with no valid epoch or timezone terminator, the regex engine explores an exponential/quadratic number of match permutations before it can conclude that the line does not match. Because Git object lines can be supplied with attacker-controlled length and content, an attacker can choose input sizes that maximize the backtracking cost.

The attack surface is any code path where GitPython reads Git objects from an untrusted source. Repositories supplied remotely — via git clone, fetched objects, or directly served git protocol/HTTP responses — flow into GitPython's object parsing routines and reach the vulnerable regex. The flaw is classified as CWE-1333 (Inefficient Regular Expression Complexity), the standard ReDoS weakness class.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The technical description above is derived directly from the NVD description of the affected pattern and function; no further code-level detail is asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (ReDoS via regex backtracking) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies a system that processes Git repositories using GitPython (for example, a hosted repository analysis service, a CI job that clones third-party repositories, or a tool that imports untrusted repository data). Because the vulnerable parsing occurs client-side, the attacker does not need to compromise the target service — only to have the target parse attacker-supplied repository content.

2. Triggering the flaw class. The attacker crafts a commit or tag object whose author, committer, or tagger line consists of a very long sequence of space characters that lacks a valid epoch or timezone field. Per the NVD description, this input drives the _re_actor_epoch pattern in parse_actor_and_date into quadratic backtracking.

3. Payload/execution method at the vulnerability-class level. The crafted object is delivered as part of a repository the victim parses — for example, served from an attacker-controlled Git remote. When GitPython calls parse_actor_and_date on the malformed actor line, the regex engine consumes CPU proportional to the square of the input length.

4. Post-exploitation impact. The result is CPU exhaustion on the host process performing the parse. Availability impact only — there is no code execution, data disclosure, or integrity impact associated with this flaw. Sustained or repeated triggering can stall or deny service to the parsing application or the CI/hosting environment that depends on it.

Impact Assessment

CVSS 3.1 base score 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Network attack vector, low attack complexity, no privileges or user interaction required, and unchanged scope. The sole affected security property is availability.

Affected systems are any deployments that use GitPython before 3.2.0 to parse Git object metadata from untrusted repositories. Blast radius is limited to the process and host performing the parse; a single malicious repository, if parsed repeatedly or with a sufficiently large crafted line, can render the parsing service unresponsive. Downstream CI/CD pipelines, code-scanning gateways, and repository-hosting integrations that depend on that service may experience cascading workflow delays. EPSS has not yet been scored by FIRST.org, and CISA KEV does not list this CVE, so no confirmed in-the-wild exploitation is documented.

Detection Guidance

Sigma Rule

title: GitPython ReDoS via Malicious Commit/Tag Actor Line
id: 3f9c1e2a-7b4d-4c8e-9a1f-6d2e5b8c1017
status: experimental
description: Detects processes parsing Git objects with abnormally long space-filled actor/committer/tagger lines, indicative of CVE-2026-110856 ReDoS attempts against GitPython parse_actor_and_date.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110856
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
      - '/git'
      - '/python'
      - '/python3'
  selection_args:
    CommandLine|contains:
      - 'clone'
      - 'fetch'
      - 'parse_actor_and_date'
  condition: selection_tool and selection_args
level: medium
falsepositives:
  - Legitimate large repository operations
  - CI/CD cloning of internal repositories

YARA Rule

rule CVE_2026_110856_GitPython_ReDoS_ActorLine
{
    meta:
        description = "Detects Git commit/tag object content with suspiciously long space runs in actor/committer/tagger lines targeting GitPython _re_actor_epoch ReDoS (CVE-2026-110856)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110856"
        date = "2026-01-01"
        severity = "high"

    strings:
        $author   = "author " ascii nocase
        $committer = "committer " ascii nocase
        $tagger   = "tagger " ascii nocase
        $spacerun = /\x20{64,}/ ascii

    condition:
        any of ($author, $committer, $tagger) and $spacerun
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-110856 Possible GitPython ReDoS - Long Space-Filled Actor Line in Git Object Fetch"; flow:established,to_client; content:"committer "; nocase; content:"|20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20|"; distance:0; within:4096; threshold:type both, track by_src, count 1, seconds 60; classtype:denial-of-service; sid:2026110856; rev:1; reference:cve,CVE-2026-110856;)

Elastic Detection

process where event.type == "start" and
  process.name in ("git", "python", "python3") and
  process.args : ("*clone*", "*fetch*") and
  process.args_count > 0

Splunk SPL Query

index=endpoint sourcetype=process:execution (process_name=git OR process_name=python OR process_name=python3) (process_command_line="*clone*" OR process_command_line="*fetch*")
| stats count values(process_command_line) as cmds by host process_name
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="gitpython_redos,">
  <rule id="110856" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">git|python|python3</field>
    <field name="process.command_line" type="pcre2">(?i)(clone|fetch|parse_actor_and_date)</field>
    <description>CVE-2026-110856: Possible GitPython ReDoS activity - repository parse with actor-line content</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED) — no patch evidence has been identified from any tracked source, and the version range indicates GitPython versions before 3.2.0 are affected. No vendor fix or workaround has been published per the available data.

1. Immediate mitigations.

   • Do not parse Git repositories from untrusted or unverified sources with GitPython.
   • Apply CPU/resource limits (cgroups, ulimits, container CPU quotas) to any process performing repository parsing so a runaway regex is contained.
   • Apply input size limits and timeouts around repository fetch and object-parsing operations.
   • Isolate repository parsing in short-lived, resource-capped workers where possible.

2. Patch/upgrade steps.

   • No confirmed fixed version is available from tracked sources. Monitor GitPython release channels and the NVD entry for a fixed release; the affected range is versions before 3.2.0. Upgrade only once a vendor-confirmed fix is published.

3. Long-term hardening.

   • Replace or wrap vulnerable regex-based parsing where feasible and fuzz-test parsing functions with adversarial inputs.
   • Adopt dependency monitoring that flags ReDoS-class weaknesses (CWE-1333) in third-party libraries.
   • Enforce least-privilege and resource governance on any automation that processes externally supplied repositories.

References

• NVD — CVE-2026-110856: https://nvd.nist.gov/vuln/detail/CVE-2026-110856
• CWE-1333 — Inefficient Regular Expression Complexity: https://cwe.mitre.org/data/definitions/1333.html
• GitPython project repository (monitor for patched release): https://github.com/gitpython-developers/GitPython
• FIRST.org EPSS (currently unscored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaign or exploit-in-the-wild evidence is documented for CVE-2026-110856 at the time of writing. No public PoC or Nuclei template is available.