AI Briefing
KOSign in

Git releases 2.56.1 to fix six security vulnerabilities including arbitrary code execution

·2026.11.11 03:00

Key point

The fixes address arbitrary code execution during recursive clones, path traversal, and memory corruption, with backports available for Git versions 2.50.2 through 2.55.1.

Details

  • Git 2.56.1 addresses six security vulnerabilities, including arbitrary code execution when recursively cloning a malicious repository and memory corruption during merges or binary patch processing.
  • Backports are available for Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2, with a recommendation to update applications that bundle Git.
  • CVE-2026-111760 allows an attacker to replace a submodule's .git file with a symbolic link to execute malicious code during a recursive clone, fixed by rejecting extremely long index entry paths.
  • CVE-2026-113408 involves path traversal through a server's advertised HEAD in Git protocol v2, where a malicious server can supply a name with path-traversal components to write outside the intended reference directory.
  • CVE-2026-114467 causes stack corruption when stripping GPG signatures from messages containing more than two signatures, potentially leading to denial of service for hosting services performing merges.
  • CVE-2026-114469 allows out-of-bounds reads when applying binary patches that expand beyond the 1 GiB input-size limit, fixed by checking the declared uncompressed size.
  • CVE-2026-105437 results in heap corruption during large merges due to integer overflow in memory calculation, affecting applications and hosting services merging untrusted content.
  • CVE-2026-114466 exposes filesystem access through fast-import streams via rewrite-submodules-from, rewrite-submodules-to, and export-pack-edges options, which are now rejected unless --allow-unsafe-features is explicitly enabled.
  • GitHub has deployed fixes to github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency, with updates for GitHub Enterprise Server available in versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4.
securitygithubgitvulnerabilitycvepatch
Read originalShare on Threads

This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.

Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.

Related

RedditApiiro Finds 1,122 Public Repositories Leaking Secrets via Claude Code SettingsCloudflare BlogCloudflare launches Zero Wire, a public vulnerability intelligence feed on RadarRedditllama.cpp CVE-2026-116096: Pocket-TTS heap out-of-bounds write requires local accessGitHub BlogGitHub moves busiest Git repos to Azure with per-reference write serializationGitHub BlogStaying Evergreen: How we automated secure access and repo hygiene in a shared orgVercel BlogVercel Security Review now scans unlinked GitHub repositories