The vulnerability is a regular expression denial‑of‑service flaw located in the _re_actor_epoch pattern used by GitPython's parse_actor_and_date routine. The flaw allows an attacker to trigger quadratic backtracking by inserting long, space‑filled lines without a valid epoch or timezone in commit, author, or tag objects. When GitPython processes such objects, the regular expression engine exhausts CPU resources, potentially causing the application or any dependent process to become unresponsive.

Affected systems include any environment that uses GitPython versions earlier than 3.2.0. This covers client applications, CI pipelines, code analysis tools, and other services that rely on GitPython for repository parsing. The vulnerable logic is part of the core library and applies to author, committer, and tagger lines in all commit and tag objects.

The CVSS score of 8.7 denotes high severity, with a lack of an EPSS score leaving the exact exploitation probability uncertain. The vulnerability is not listed in CISA KEV, but it can still be leveraged by attackers who control a repository feed or can force a client to clone or pull from a malicious repository. The attack vector would therefore likely be a supply‑chain or malicious repository served to GitPython consumers, potentially leading to CPU exhaustion and denial of service. Even without a known exploit, the high CVSS and potential for service disruption warrant urgent remediation.