CVE-2026-110856 is a High severity (CVSS 7.5) regular expression denial of service in GitPython before 3.2.0. A repository with a commit or tag line full of spaces can burn CPU while it is parsed. Upgrade to GitPython 3.2.0, the fixed release.
What's affected
The record says GitPython before 3.2.0 is affected. The GitHub advisory lists affected versions as 3.1.62 and earlier and patched versions as 3.2.0 or later. The weakness is CWE-1333, inefficient regular expression complexity.
According to the advisory, this is a residual of an earlier issue. A previous fix made one parser regex-free, but parse_actor_and_date still ran a pattern named _re_actor_epoch on author, committer and tagger lines. The pattern can match the same run of spaces in two ways, so when the epoch or timezone is missing or malformed, the engine retries every split and cost grows quadratically with line length.
Severity differs by source. The record gives 7.5 (High), and VulnCheck lists 8.7 on a CVSS 4.0 vector. The GitHub advisory rates it Moderate. We follow the record in the title, and all three agree on the fix.
How to check if you're exposed
Check the installed version.
pip show GitPython
Version 3.1.62 and lower are in range, and so are versions before 3.2.0 according to the record. Also find GitPython in dependency files, since it is often pulled in by other tools rather than installed on purpose.
pip freeze | grep -i gitpython
The risk depends on whether your code reads commits or tags from repositories that outsiders control. A CI service, code analysis tool or bot that clones user repositories is more exposed than a script that works on your own repos. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade GitPython to 3.2.0 or later and rebuild images and virtual environments.
- Pin the new version in your requirements or lock file so older copies do not return through other packages.
- Apply time limits and memory limits to jobs that parse untrusted repositories, so a slow parse cannot starve other work.
- Run repository analysis in isolated workers that can be stopped without affecting the rest of the service.
- Watch for jobs with CPU use that stays high while reading commit data.
Why it matters
Regular expression denial of service happens when a pattern has more than one way to match the same input, and a failed match forces the engine to try each way. Short lines are fast. Lines of tens of kilobytes can take seconds each.
Git objects are untrusted data when the repository comes from someone else. Tools that process them at scale, such as code scanners and review bots, need input limits as well as patches. The advisory also shows why partial fixes leave gaps: the same class of problem remained in the neighbouring function. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which GitPython version fixes CVE-2026-110856?
3.2.0, according to the GitHub advisory.
Is it exploitable on my own repositories?
The trigger is a malformed commit or tag line. Repositories you control are low risk, but repositories from outside parties are the case to plan for.
Sources
Last reviewed: 18 October 2026.
