Git patches six flaws, including code execution on recursive clone
Original title: Git security vulnerabilities announced
Fixes are in Git 2.56.1 and six maintenance releases; GitHub has patched its hosted services and listed GHES updates.
The Git project released updates for six vulnerabilities in recursive clones, reference handling, merges, binary patches, and fast-import. The most serious can run attacker-controlled code when recursively cloning a malicious repository after an integer truncation lets a long path replace a submodule .git file with a symlink to malicious hooks. Other bugs can write outside the intended reference directory, corrupt memory, crash Git, or let untrusted fast-import streams read or write files. GitHub says it deployed fixes on github.com and Enterprise Cloud and published Enterprise Server updates.
Unconfirmed: The announcement does not say whether any of the flaws are being exploited.
- Patched Git releases are 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2.
- CVE-2026-111760 is arbitrary code execution during a recursive clone.
- Unsafe fast-import features stay blocked unless --allow-unsafe-features is enabled.
- GitHub Enterprise Server fixes are 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
Impact: Code execution, out-of-tree writes, crashes, or file access
| Product | Affected | Fixed in |
|---|---|---|
| Git | — | 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2 |
| GitHub Enterprise Server | — | 3.19.15, 3.20.11, 3.21.9, 3.22.4 |
- 1.Update to Git 2.56.1 or the patched release for your maintenance series.
- 2.Update applications and automation that bundle their own copy of Git.
- 3.Upgrade GitHub Enterprise Server to 3.19.15, 3.20.11, 3.21.9, or 3.22.4.
- Vendors
- GitHub
- Organizations
- Git project
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105437 | Heap buffer overflow in Git three-way merge via conflict-marker-size | 7.5 | — | ||
| CVE-2026-111760 | — | — | — | ||
| CVE-2026-113408 | — | — | — | ||
| CVE-2026-114466 | — | — | — | ||
| CVE-2026-114467 | — | — | — | ||
| CVE-2026-114469 | — | — | — |
From the original article
4 min read at github.blog
Git is releasing updates addressing six security vulnerabilities affecting recursive clones, reference handling, merges, binary patches, and imports. Here is what users need to know. The post Git security vulnerabilities announced appeared first on The GitHub Blog.
By Elijah Newren · github.blog
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.