The Git project shipped fixes for six vulnerabilities this week in Git 2.56.1, with backports in 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2, The Hacker News and Help Net Security report.
The big one: CVE-2026-111760
An integer truncation in Git’s index handling lets an extremely long path pass the safety check and then get written to disk under a shorter name, which an attacker can set to .git. In a freshly cloned submodule, .git is a file, so an attacker can swap it for a symlink to a folder full of malicious hooks. If you clone the repo recursively, their code runs.
The other five
- CVE-2026-113408: When you clone an empty repo over protocol v2, a malicious server can send a HEAD target that writes outside the refs directory.
- CVE-2026-114467: A tag with more than two GPG signatures can overflow a stack array during a merge.
- CVE-2026-114469: A small binary patch can expand past the 1 GiB limit and crash Git.
- CVE-2026-105437: A huge merge with a big conflict-marker-size can corrupt heap memory. GitLab says servers that run
git merge-treefor merge checks are the likely target. The workaround isconflict-marker-size=7in each repo’s info/attributes. - CVE-2026-114466: Three fast-import features could read or write arbitrary files. They now require
--allow-unsafe-features.
GitHub has patched github.com and Enterprise Cloud. GitHub Enterprise Server fixes are in 3.19.15, 3.20.11, 3.21.9 and 3.22.4. GitHub Desktop and the GitHub Copilot app are still being prepared, and as of Tuesday Git for Windows hadn’t shipped a 2.56.1-based build.
My take
Update Git on every box you’ve got, and remember the apps that bundle their own copy. Until everything is patched, don’t recursively clone repos you don’t trust, and don’t merge tags or apply binary patches from strangers. I’m marking this Needs Garlic because Windows and the bundled-Git apps aren’t fixed yet.
God Bless, and Needs Garlic!
