VulnSocial

CVE-2026-87819Active Exploitation(gitpython_project / gitpython)

LOWCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for gitpython_project gitpython systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.

gitpython_project CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-1333

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitpython

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-09); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
gitpython_project
Products
gitpython

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-09: 1Mentions · 2026-10-01: 1Active Exploitation · 2026-09-09: 1Technical Details · 2026-09-09: 1Technical Details · 2026-10-01: 109-0910-01
Signal classification2 categories
Active Exploitation
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-091
Active Exploitation1
2026-10-011
Disclosure1
Full discourse2 posts
  • DailyCVE@dailycve
    Disclosure

    🔴 GitPython, Regular Expression Denial of Service (ReDoS), #CVE-2026-87819 (High) -DC-Oct2026-2686 https://dailycve.com/gitpython-regular-expression-denial-of-service-redos-cve-2026-87819-high-dc-oct2026-2686/

    Post summary

    The tweet announces CVE-2026-87819, a ReDoS vulnerability in GitPython, providing the CVE ID, severity, and a link to a detailed article, but offers no PoC, exploit tool, active exploitation claim, or patch information.

    0000042
    239 followersView on X
  • NewNormal Security@NewScanTeam
    Active Exploitation

    NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 9 Sep 2026 𝗔𝗱𝗱𝗲𝗱 𝘁𝗼 𝗡𝗲𝘄𝗦𝗰𝗮𝗻 𝘁𝗼𝗱𝗮𝘆: 🚨 Actively exploited pre-authentication RCE — exposed N-central servers now surface the advisory before attackers take the RMM and managed endpoints (N-able CVE-2026-86218) 📦 Regular-expression denial of service — crafted commit author metadata can exhaust apps pinned to vulnerable GitPython builds (GitPython CVE-2026-87819) 📦 Regular-expression denial of service — attacker-controlled Git clone paths can exhaust vulnerable n8n workers (n8n CVE-2026-86081) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RCE #CSO #REDTEAM

    Post summary

    The post announces a daily CVE roundup that highlights an actively exploited N‑able RCE and lists regex DoS alerts for GitPython and n8n, without providing PoC, exploit code, or patch guidance.

    0000062
    7 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgitpython_projectgitpython-python-

Explore more

Back to dashboardgitpython_project CVEsgitpython vulnerabilities