Git Addresses Six Critical Vulnerabilities, Including Code Execution and Path Traversal
Git has released patched versions 2.56.1 and older series to fix six security flaws, including arbitrary code execution via malicious recursive clones and path traversal.
The Git project has announced the release of updated versions to address six critical security vulnerabilities discovered within its widely used version control system. The fixes are available in Git 2.56.1, with backports provided for older maintenance series including 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Users and organizations are strongly advised to update to the latest patched versions to mitigate these risks.
One of the most severe vulnerabilities, tracked as CVE-2026-111760, allows for arbitrary code execution during recursive clone operations. This exploit is possible due to an integer truncation in Git's index handling, which can cause an extremely long path to be validated under one name but written using a shorter, malicious name. An attacker could leverage this to replace a submodule's .git file with a symbolic link pointing to malicious configuration or hooks, leading to code execution when Git processes the recursive clone.
Another significant flaw, CVE-2026-113408, involves path traversal through a server's advertised HEAD in Git protocol v2. When cloning an empty repository, a malicious server could advertise a HEAD symref pointing to an unborn branch. Git's failure to validate this symref before storing it locally allows a malicious server to supply a name containing path-traversal components. This could lead to unintended file writes outside the intended directory, especially with the files reference backend.
The updates also address memory corruption issues. CVE-2026-114467 details a stack corruption vulnerability that can occur when removing GPG signatures. Git's assumption of at most two signatures can be bypassed by a specially crafted message with more signatures, leading to memory corruption and potential denial of service, particularly affecting hosting services that merge tags on behalf of users.
Furthermore, CVE-2026-114469 describes an out-of-bounds read vulnerability during the application of binary patches. While Git has checks for large patches, a crafted binary patch can bypass these by having a small compressed size but expanding significantly after decompression. This bypass can lead to an out-of-bounds read, crashing Git. The fix now also checks the declared uncompressed size before processing binary patches.
Two additional vulnerabilities, CVE-2026-105437 and CVE-2026-114466, involve heap corruption during large merges and filesystem access via fast-import streams, respectively. The former can occur when Git's merge machinery calculates memory needs for a large result, leading to buffer overflows and heap corruption. The latter allows untrusted input streams to access files outside the repository through certain commands like rewrite-submodules-from/to, unless explicitly overridden with a security warning.
GitHub has confirmed that these vulnerabilities have been addressed across its platforms, including github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency. Updates for GitHub Enterprise Server are also available. The company urges administrators to upgrade as soon as possible and is coordinating updates for GitHub Desktop, GitHub Copilot, GitHub Codespaces, and GitHub Actions. For users unable to update immediately, the advice is to clone only from trusted servers and avoid operations involving untrusted content or repositories.