new file mode 100644
@@ -0,0 +1,78 @@
+From dc8a898eb74ac5614c7ca013de21e30e8dac2e17 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Tue, 11 Aug 2026 14:18:25 +0200
+Subject: [PATCH 37/38] fix: parse actor identities without regular expressions
+
+<!-- agent -->
+GHSA-g5vv-9gxw-82hx reports quadratic backtracking when an actor
+identity contains a long unterminated email delimiter.
+
+Add a regression that exercises a 20,000-character malformed identity,
+then replace both actor regexes with direct delimiter scans following
+Git's first-opening, first-closing delimiter behavior. Keep GitPython's
+whole-string fallback when either delimiter is absent.
+
+Reference Git baseline cf5497b14c5a24f10c13f7e0ee85cb95
+ident.c::split_ident_line and its invalid-committer cases in
+t/t9300-fast-import.sh. Also reference gix-actor's signature decoder and
+lenient identity tests.
+
+CVE: CVE-2026-87819
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8]
+
+Backport Changes:
+- Omit upstream regression test changes because the current PyPI
+ source archive does not include its test suite.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 751473a5f3221d6f989291cbebcc404353fd3ba8)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/util.py | 24 ++++++++----------------
+ 1 file changed, 8 insertions(+), 16 deletions(-)
+
+diff --git a/git/util.py b/git/util.py
+index d3eaeb8b..292d5671 100644
+--- a/git/util.py
++++ b/git/util.py
+@@ -756,10 +756,6 @@ class Actor:
+ can be committers and authors or anything with a name and an email as
+ mentioned in the git log entries."""
+
+- # PRECOMPILED REGEX
+- name_only_regex = re.compile(r"<(.*)>")
+- name_email_regex = re.compile(r"(.*) <(.*?)>")
+-
+ # ENVIRONMENT VARIABLES
+ # These are read when creating new commits.
+ env_author_name = "GIT_AUTHOR_NAME"
+@@ -802,18 +798,14 @@ class Actor:
+
+ :return: Actor
+ """
+- m = cls.name_email_regex.search(string)
+- if m:
+- name, email = m.groups()
+- return Actor(name, email)
+- else:
+- m = cls.name_only_regex.search(string)
+- if m:
+- return Actor(m.group(1), None)
+- # Assume the best and use the whole string as name.
+- return Actor(string, None)
+- # END special case name
+- # END handle name/email matching
++ line = string.partition("\n")[0]
++ left_bracket = line.find("<")
++ right_bracket = line.find(">", left_bracket + 1)
++ if left_bracket >= 0 and right_bracket >= 0:
++ return Actor(line[:left_bracket].rstrip(), line[left_bracket + 1 : right_bracket])
++
++ # Assume the best and use the whole string as name.
++ return Actor(string, None)
+
+ @classmethod
+ def _main_actor(
+--
+2.35.6
new file mode 100644
@@ -0,0 +1,58 @@
+From 9dbeb7f4547045013db152c84d7dbacbdf12bc62 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Fri, 28 Aug 2026 08:37:50 +0200
+Subject: [PATCH] Restore deprecated Actor regex compatibility
+
+Keep the existing name_email_regex attribute available for Scarthgap
+callers while warning about its quadratic behavior on malformed input.
+The parser continues to use the CVE fix's delimiter scan.
+
+CVE: CVE-2026-87819
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f]
+
+Backport Changes:
+- Keep the Scarthgap Actor._from_string API and fold only the deprecated
+ regex shim; Actor.from_string was added after 3.1.42.
+- Omit the upstream regression tests because the current PyPI source
+ archive does not include its test suite.
+
+(cherry picked from commit bc63b027e2fc737e2ec0222bfa764e1aa76a427f)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/util.py | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/git/util.py b/git/util.py
+index 292d5671..d2f1915b 100644
+--- a/git/util.py
++++ b/git/util.py
+@@ -751,11 +751,26 @@ class CallableRemoteProgress(RemoteProgress):
+ self._callable(*args, **kwargs)
+
+
++class _DeprecatedActorNameEmailRegex:
++ _pattern = re.compile(r"(.*) <(.*?)>")
++
++ def __get__(self, _instance: Any, _owner: Any) -> Pattern[str]:
++ warnings.warn(
++ "Actor.name_email_regex is deprecated because matching long malformed strings can take quadratic time. "
++ "Use Actor._from_string() to parse actor identities, or Actor(name, email) when the fields are separate.",
++ DeprecationWarning,
++ stacklevel=2,
++ )
++ return self._pattern
++
++
+ class Actor:
+ """Actors hold information about a person acting on the repository. They
+ can be committers and authors or anything with a name and an email as
+ mentioned in the git log entries."""
+
++ name_email_regex = _DeprecatedActorNameEmailRegex()
++
+ # ENVIRONMENT VARIABLES
+ # These are read when creating new commits.
+ env_author_name = "GIT_AUTHOR_NAME"
+--
+2.35.6
+
@@ -49,6 +49,8 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-78675.patch \
file://CVE-2026-87817.patch \
file://CVE-2026-87818.patch \
+ file://CVE-2026-87819_p1.patch \
+ file://CVE-2026-87819_p2.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [3], using the commit shown in [1] and [2]. [1] https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8 [2] https://github.com/gitpython-developers/GitPython/commit/bc63b027e2fc737e2ec0222bfa764e1aa76a427f [3] https://www.cve.org/CVERecord?id=CVE-2026-87819 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python3-git/CVE-2026-87819_p1.patch | 78 +++++++++++++++++++ .../python3-git/CVE-2026-87819_p2.patch | 58 ++++++++++++++ .../python/python3-git_3.1.42.bb | 2 + 3 files changed, 138 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p1.patch create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-87819_p2.patch