Git Patches Six Security Vulnerabilities in Maintenance Update

The Git project has released security updates addressing six vulnerabilities across its core engine, reference backends, and merge machinery. The fixes are delivered in Git 2.56.1 alongside backports for maintenance releases ranging from Git 2.50.2 through 2.55.1. The flaws introduce risks including remote arbitrary code execution during recursive repository clones, path traversal through server-advertised references, out-of-bounds memory reads, and heap buffer corruption during large merges. Development teams, hosting providers, and system administrators should prioritize updating local installations, CI/CD pipeline automation, and enterprise repository servers to protect against exploitation from malicious repositories and untrusted inputs.

Git Maintenance Releases Patch Six Security Flaws

Announced on November 10, 2026, the coordinated update addresses vulnerabilities that affect local developer workflows and automated server-side operations. The Git maintainers published patches in the current feature series as Git 2.56.1, accompanied by security backports across six older release branches: Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. The security fixes resolve distinct failure modes spanning index validation, protocol v2 communication, cryptographic signature stripping, binary patch parsing, and stream imports.

According to the official GitHub announcement, additional hardening measures were introduced alongside the explicit defect repairs. These include overflow checks on memory allocations for index entries during checkout and tree processing. The checks complement path-length boundaries to ensure allocation sizes cannot truncate or overflow when Git transfers file paths into system memory.

Submodule Truncation, Path Traversal, and Memory Corruption Risks

The most critical flaw in the advisory is CVE-2026-111760, which exposes developers to arbitrary code execution during recursive clones. Git normally validates working tree paths to prevent overwriting repository metadata, specifically the .git administrative directory. However, an integer truncation bug in index handling permitted an extremely long path to pass initial validation under its full name while being written under a truncated shorter name. Attackers can exploit this discrepancy to replace a submodule’s .git directory with a symbolic link pointing to a location containing malicious hooks or configuration files. When Git subsequent operations traverse that submodule, attacker-controlled commands execute automatically on the host.

Protocol-level interactions present a second vector through CVE-2026-113408. When a client clones an empty repository over Git protocol v2, the remote server can advertise a HEAD symbolic reference pointing to an unborn branch that contains no commits. Previous versions of Git failed to validate this target path prior to storing it locally. A malicious server could transmit path-traversal sequences within the branch name, allowing subsequent branch updates under the files backend to write references outside the designated repository directory. The updated versions now validate all advertised targets and reference names received via protocol v2 before local acceptance.

The remaining vulnerabilities involve memory safety and parser limitations during automated processing:

• Signature Handling (CVE-2026-114467): Git previously assumed a commit or tag message would contain no more than two GPG signatures. Processing a specially crafted tag containing three or more signatures caused Git to write beyond a fixed-size stack array during signature stripping, leading to memory corruption and potential denial of service on hosting platforms performing automated merges.
• Binary Patch Inflation (CVE-2026-114469): While git-apply rejects raw patches exceeding approximately 1 GiB, the safety check historically evaluated only the compressed input stream. A compressed binary patch designed to expand past the 1 GiB boundary upon decompression triggered out-of-bounds memory reads, terminating the process unexpectedly.
• Heap Overflow in Merges (CVE-2026-105437): In the xdiff merge engine, buffer allocation calculations for large merge results could overflow when handling numerous merge conflicts combined with a high conflict-marker-size attribute. This resulted in an undersized buffer allocation and subsequent out-of-bounds heap writes during untrusted or local merge operations.
• Stream Import Access (CVE-2026-114466): The git fast-import tool allowed specific parameters, including rewrite-submodules-from, rewrite-submodules-to, and export-pack-edges, to read or append data to arbitrary files outside the repository. Git now blocks these operations by default unless callers explicitly pass the --allow-unsafe-features flag.

Affected Environments and Operational Remediation

Because Git functions both as an interactive developer utility and as backend infrastructure for continuous integration pipelines, exposure spans developer workstations, build servers, and enterprise hosting environments. Cloud services and managed hosting providers have already begun deploying platform-level mitigations. GitHub reported that patches have been rolled out across github.com, GitHub Enterprise Cloud, and data residency instances. Patched releases for GitHub Enterprise Server are available in versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4.

Organizations must coordinate updates across multiple software layers, as standalone command-line Git installations are often distinct from embedded copies used by development tools. Packaged updates are being coordinated for applications that bundle Git, including GitHub Desktop and GitHub Copilot extensions, while hosted container environments such as GitHub Codespaces and GitHub Actions runners are being refreshed with patched binaries.

For enterprise infrastructure teams that cannot apply maintenance updates immediately, operational mitigations reduce exposure to untrusted input sources:

1. Restrict repository cloning operations to verified, authenticated servers, and disable recursive cloning flags (--recurse-submodules) when fetching untrusted third-party code.
2. Prohibit automated merges of untrusted branches, tags, and pull requests on centralized CI/CD runners until host engines are updated.
3. Refrain from applying compressed binary patches or processing git fast-import streams originating from unauthenticated sources, and avoid executing fast-import scripts with the --allow-unsafe-features override.

What happens next

Operating system distributions and enterprise package managers are rolling out patched builds of Git 2.56.1 and corresponding maintenance backports. System administrators should audit central package repositories to verify that automated build environments, developer laptops, and CI/CD agents pull updated packages rather than stale cached images. Security teams should review automation scripts that invoke Git commands against third-party or user-submitted repositories to ensure strict input boundaries remain enforced.