GitPython versions prior to 3.1.60 include a regular expression denial of service flaw in the Actor.name_email_regex component that processes commit author and committer strings. A crafted commit can contain an author field with an incomplete angle bracket, forcing the regex to engage in quadratic backtracking. This exhausts CPU resources for over two minutes per commit when accessed, effectively disrupting services that rely on GitPython for repository inspection or manipulation. The weakness is a classic ReDoS attack (CWE‑1333) and can lead to significant performance degradation or service unavailability.

The affected product is the GitPython library provided by the gitpython‑developers. The vulnerability exists in all releases before 3.1.60. Systems that embed GitPython in their codebase (for example CI pipelines, hosting services, or custom git tools) are at risk if they use a pre‑3.1.60 build. No further product or version detail is recorded beyond the main library name.

The base score of 8.7 indicates high severity, but no EPSS score is available, meaning the current likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, which suggests it is not a current, widely exploited exposure. The likely attack vector is a crafted commit object; the typical vector is either a local attacker who can inject commits into a repository that GitPython processes, or a remote attacker that can insert malicious commits through a buggy ingestion API. The exploitation would require the target to parse at least one malformed commit, after which the denial of service would manifest as a prolonged CPU spike.