GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4872 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4872-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Emmanuel Arias     October 31, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git     Version        : 3.1.30-1+deb12u3     CVE ID         : CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244                      CVE-2026-67322 CVE-2026-67323 CVE-2026-67324 CVE-2026-67325                      CVE-2026-67326 CVE-2026-69097 CVE-2026-73619 CVE-2026-73620                      CVE-2026-73621 CVE-2026-73622 CVE-2026-73623 CVE-2026-73624                      CVE-2026-73625 CVE-2026-76217 CVE-2026-76218 CVE-2026-76219                      CVE-2026-76220 CVE-2026-76221 CVE-2026-76222 CVE-2026-78675                      CVE-2026-78676 CVE-2026-78677 CVE-2026-78678 CVE-2026-78679                      CVE-2026-87817 CVE-2026-87818 CVE-2026-87819 CVE-2026-100689                      CVE-2026-110855 CVE-2026-110856 CVE-2026-110857 CVE-2026-110858                      CVE-2026-110859 CVE-2026-110860 CVE-2026-114145     Debian Bug     : 1135349 1135350 1143454 1143602 1144344 1144929

    Multiple security vulnerabilities were discovered in python-git     (GitPython), a Python library used to interact with git repositories.
    These issues could result in arbitrary command execution, path traversal     with arbitrary file read or write, git config injection, leaking of     secrets through environment variable expansion or denial of service     (ReDoS).

    CVE-2026-42215

        Unsafe options passed as underscored keyword arguments were not         blocked, which could lead to command execution.

    CVE-2026-42284

        Unsafe options were not checked after splitting multi_options with         shlex, which could lead to command execution.

    CVE-2026-44243

        When manipulating references, access to files outside the repository         was not prevented, allowing arbitrary file access.

    CVE-2026-44244

        The config writer did not reject control characters in config values,         allowing config injection.

    CVE-2026-67322

        Environment variables were expanded in clone URLs, which could leak         secrets to a remote host.

    CVE-2026-67323

        Unsafe options (--exec, --upload-pack, ...) were not guarded in the         archive, fetch, pull, push, ls-remote, blame and revision APIs, which         could lead to command execution.

    CVE-2026-67324

        Abbreviated long options bypassed the unsafe option checks, leading to         command execution.

    CVE-2026-67325

        Joined short options bypassed the unsafe option checks, leading to         command execution.

    CVE-2026-67326

        Config section names were not validated before writing, allowing         config injection.

    CVE-2026-69097

        Config section names containing an unquoted closing bracket could         inject arbitrary settings into .git/config.

    CVE-2026-73619

        The --add-file, --add-virtual-file (archive) and --bundle-uri (clone)         options were missing from the unsafe option lists, which could lead to         command execution or arbitrary file access.

    CVE-2026-73620

        Unsafe options in IndexFile.checkout() (--prefix) and         TagReference.create() (-F/--file) were not blocked, which could write         to or read from arbitrary filesystem paths.

    CVE-2026-73621

        Unsafe output options were not rejected in Commit.count, which could         write to arbitrary filesystem paths.

    CVE-2026-73622

        Environment variables were expanded in remote and submodule URLs,         which could leak secrets to a remote host.

    CVE-2026-73623

        The unsafe --template option was not rejected when cloning, which         could read from arbitrary filesystem paths.

    CVE-2026-73624

        Unsafe output options were not guarded in diff operations, which could         write to arbitrary filesystem paths.

    CVE-2026-73625

        The values of split short options were not validated, which could         bypass the unsafe option checks in clone, remote, revision, blame and         archive operations.

    CVE-2026-76217

        The --pathspec-from-file options were not guarded in IndexFile.remove,         Head.checkout and HEAD.reset, which could read from arbitrary         filesystem paths.

    CVE-2026-76218

        Unsafe git init options (--template, --separate-git-dir) were not         guarded in Repo.init, which could read from or write to arbitrary         filesystem paths.

    CVE-2026-76219

        The --index-output option was not guarded in read-tree calls made by         from_tree, merge_tree and reset, which could write to an arbitrary         path.

    CVE-2026-76220

        The value joined to one-character options was not checked when         split_single_char_options is false, which could bypass the unsafe         option checks.

    CVE-2026-76221

        Config option names containing characters that could inject arbitrary         settings when writing the config were not rejected.

    CVE-2026-76222

        Submodule names read from .gitmodules were not validated before         filesystem operations, allowing path traversal outside the repository.

    CVE-2026-78675

        Include directives in .gitmodules were processed, which could read         arbitrary files.

    CVE-2026-78676

        Multiline config values were not preserved when writing, which could         inject new options into the config.

    CVE-2026-78677

        The --separate-git-dir option was not blocked in Repo.clone() and         Repo.clone_from(), which could write repository metadata to an         arbitrary path.

    CVE-2026-78678, CVE-2026-78679

        File-reading options were not blocked in blame, diff and tag APIs,         which could read arbitrary files.

    CVE-2026-87817

        Repository discovery did not prefer the .git entry nor validate         candidate git directories, diverging from git's behaviour.

    CVE-2026-87818

        The --no-index option was not treated as an unsafe diff option, which         allowed diffing arbitrary filesystem paths.

    CVE-2026-87819

        Actor identities were parsed with regular expressions, allowing         quadratic backtracking (ReDoS) on malformed identities.

    CVE-2026-100689

        Submodule checkout paths that resolve outside the repository or         through a symbolic link were not rejected in Submodule.update, unlike         in add and move.

    CVE-2026-110855

        Environment variables were expanded in the separate_git_dir path when         cloning, so repository metadata could be written to an unexpected         location.

    CVE-2026-110856

        Actor identities and dates in commit authors, committers and taggers         were parsed with backtracking regular expressions, allowing excessive         CPU use (ReDoS) on malformed metadata.

    CVE-2026-110857

        The unsafe option and protocol checks were incomplete in         Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which omitted         guards already used by sibling APIs.

    CVE-2026-110858

        Option-shaped remote names were not rejected in Remote.update(), which         git forwards to fetch --multiple without an option terminator,         allowing a leading-dash name to change the requested operation.

    CVE-2026-110859

        The positional reference passed by Head.checkout() was not validated         against the unsafe-option policy, so reference names originating in a         cloned repository could bypass it.

    CVE-2026-110860

        Submodule checkout, move and metadata paths that traverse intermediate         symbolic links were not rejected before performing filesystem         operations.

    CVE-2026-114145

        GitPython validated a submodule's '.git' path only after cloning into         it, which could lead to remote code execution.

    For Debian 12 bookworm, these problems have been fixed in version     3.1.30-1+deb12u3.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92861 advisory.

    This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address     the vulnerabilities described below.

    Security Fix(es):

    * python-django and python3.12-django: Remote code execution via GeoDjango spatial lookups     (CVE-2026-15307).
    * yggdrasil-worker-forwarder: Denial of Service in Go net/http due to unencrypted HTTP/2 connections     (CVE-2026-56853).
    * yggdrasil-worker-forwarder: Denial of Service via malformed RPC requests in gRPC-Go (CVE-2026-84445).
    * yggdrasil-worker-forwarder: Denial of Service via multiple ECH outer extension references in crypto/tls     (CVE-2026-97031).
    * yggdrasil-worker-forwarder: Denial of Service via crafted HTTP Range headers in Go (CVE-2026-78667).
    * yggdrasil-worker-forwarder: Denial of Service via excessive HTTP/2 SETTINGS frames in net/http     (CVE-2026-78669).
    * yggdrasil-worker-forwarder: Man-in-the-middle attacks via untrusted intermediate certificates in     crypto/x509 (CVE-2026-111943).
    * yggdrasil-worker-forwarder: golang: Denial of Service via memory limit bypass in multipart form parsing     (CVE-2026-94440).
    * openvox-server: Denial of Service via unchecked DTLS handshake reassembler buffer allocation in Bouncy     Castle for Java (CVE-2026-59646).
    * openvox-server: CPU Denial of Service via unbounded numeric parsing in jackson-databind     (CVE-2026-68497).
    * openvox-server: HTTP request smuggling via crafted chunked requests in Jetty (CVE-2026-19203).
    * openvox-server: Denial of Service via regular expression backtracking in jackson-core (CVE-2026-89407).
    * openvox-server: Denial of Service via unbounded StringBuilder growth during malformed token processing     in jackson-core (CVE-2026-89425).
    * openvox-server: Access control bypass via case-sensitive host filtering in Eclipse Jetty     (CVE-2026-18660).
    * python3.12-urllib3: Denial of Service via unbounded memory allocation in the chunk parser     (CVE-2026-97689).
    * python3.12-urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687).
    * python3.12-gitpython: Denial of Service via a crafted commit author field (CVE-2026-87819).
    * python3.12-gitpython: Denial of Service via regular expression backtracking in date parsing     (CVE-2026-110856).
    * python3.12-gitpython: Arbitrary code execution via improper submodule path validation (CVE-2026-114145).
    * python3.12-gitpython: Command injection via Remote.pull() refspec in GitPython before 3.2.0     (CVE-2026-110858).
    * python3.12-gitpython: Arbitrary file read via argument injection in branch checkout (CVE-2026-110859).
    * python3.12-gitpython: Arbitrary code execution via unsafe URL protocol handling (CVE-2026-110857).
    * python3.12-gitpython: Arbitrary code execution via path traversal (CVE-2026-78677).
    * python-gitpython: Arbitrary file read via Repo.archive() (CVE-2026-73619).
    * python3.12-pillow: Heap buffer overflow in ImagingJpegDecode (CVE-2026-112403).
    * python3.12-pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leading to code execution     (CVE-2026-112398).
    * python3.12-pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393).
    * python3.12-pillow: Denial of Service via unbounded recursion in the PDF parser (CVE-2026-112391).
    * python3.12-pillow: Denial of Service via unbounded memory expansion in MSP image decoder CVE-2026-112892
    * python3.12-pillow: Denial of Service via repeated EXIF headers CVE-2026-96643
    * python3.12-pillow: Denial of Service via duplicate page references in PDF files CVE-2026-96640
    * python3.12-pillow: Arbitrary code execution via JPEG encoder buffer overflow CVE-2026-96778
    * python3.12-pillow: Denial of Service via infinite loop during PDF page rewriting CVE-2026-112406
    * python3.12-pillow: Denial of Service via out-of-bounds read in TIFF decoding CVE-2026-112404
    * python3.12-pillow: Denial of Service via out-of-bounds read in TIFF encoder CVE-2026-112896
    * python3.12-pillow: Information disclosure via uninitialized buffer in TIFF decoding CVE-2026-112897
    * python3.12-pillow: Denial of Service via invalid pointer free during font rendering CVE-2026-112893
    * python3.12-pillow: Denial of Service via double free during image transformation CVE-2026-112402
    * python3.12-pillow: Denial of Service via crafted PDF during append operations CVE-2026-112895
    * python3.12-pillow: Denial of Service via crafted multi-frame image conversion CVE-2026-112894
    * python3.12-pillow: Denial of Service via memory exhaustion from crafted GIF image CVE-2026-112400
    * python3.12-pillow: Denial of Service via out-of-bounds memory access on zero-width images     CVE-2026-112397
    * python3.12-pillow: Denial of Service via zero-size images in rank filters CVE-2026-112392
    * python3.12-pillow: Denial of Service via crafted APNG image CVE-2026-112399
    * python3.12-pillow: Denial of Service via null pointer dereference in Image merge CVE-2026-112405
    * python3.12-pillow: Denial of Service via infinite loop during crafted MIC image parsing CVE-2026-112390
    * python3.12-pillow: Denial of Service via unbounded recursion in PDF parser CVE-2026-112391
    * python3.12-brotli: Out-of-bounds write in the Google Brotli decoder (CVE-2026-111497).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the
    _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can
    serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or
    timezone, causing quadratic backtracking and CPU exhaustion. (CVE-2026-110856)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the
    _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can     serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or     timezone, causing quadratic backtracking and CPU exhaustion. (CVE-2026-110856)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374599	Debian dla-4872 : python-git-doc - security update	Nessus	Debian Local Security Checks	Local	critical
374295	RHEL 9 : Satellite 6.19 (RHSA-2026:92861)	Nessus	Red Hat Local Security Checks	Local	critical
477471	Echo: python-git: security update to 3.2.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
477471	Echo: python-git: security update to 3.2.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
366157	Linux Distros Unpatched Vulnerability : CVE-2026-110856	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-110856

high

Tenable Plugins

critical

critical

high

high

high