Git 2.56.1 Patches Six Security Flaws Including Recursive Clone Code Execution

TL;DR

The Git project released version 2.56.1 and six maintenance builds to fix six Git security vulnerabilities. Tracked from CVE-2026-105437 to CVE-2026-114469, the bugs allow code execution during recursive clones, rogue file writes, and memory errors. Coders and server admins must update their Git packages and bundled apps right away.

Notable CVEs

Why It Matters

Git serves as the core code management tool for dev teams, build hosts, and cloud platforms worldwide. Therefore, bugs in how Git clones repos or merges code put both user PCs and servers like GitHub at risk.

Currently, neither source reports any active attacks in the wild or public exploit code for these bugs. While exact install counts remain private, over 30 million software devs use Git every day.

How the Attack Works

Recursive Clone Code Execution and Path Traversal

First, CVE-2026-111760 stems from a length truncation bug in Git’s index code. A very long file path can pass safety checks under its full name. However, Git then writes it to disk under a shorter cut name. Thus, an attacker can swap a submodule’s .git file with a symlink to a rogue hooks folder. As the report notes, “When Git subsequently uses that directory, it can execute attacker-controlled code during a recursive clone.”

Second, CVE-2026-113408 hits clones of empty repos over Git protocol v2. A bad server can send a HEAD symref with path-traversal segments pointing to an unborn branch. With the files backend, a later branch update writes data outside the reference folder. Third, CVE-2026-114466 affects git fast-import streams. Three stream options lacked safety blocks, letting untrusted streams read or append to local files.

Merge and Patch Memory Corruption

Fourth, CVE-2026-105437 is a size math overflow during huge merges with many conflicts. The advisory warns that “The overflow can cause Git to allocate a buffer that is too small, then write outside it, corrupting heap memory.” Fifth, CVE-2026-114467 causes a stack overflow when stripping GPG signatures from a tag with more than two signatures. As the report states, “This can be triggered by merging a tag containing more than two signatures, causing memory corruption and a potential denial of service.” Finally, CVE-2026-114469 lets a compressed binary patch expand past 1 GiB and trigger an out-of-bounds read crash.

Affected Versions

These six Git security vulnerabilities hit Git branches 2.50 through 2.56 before the newest point updates. They also impact GitHub Enterprise Server builds before 3.19.15, 3.20.11, 3.21.9, and 3.22.4.

Patch and Mitigation Steps

The Git project fixed all six bugs in Git 2.56.1. They also shipped backports in versions 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. GitHub already patched GitHub.com and Enterprise Cloud. Meanwhile, Enterprise Server admins must update to 3.22.4, 3.21.9, 3.20.11, or 3.19.15. Until teams can patch, devs should only clone from trusted hosts and avoid recursive clones of untrusted repos. Users should also avoid merging untrusted tags or running untrusted binary patches and fast-import streams.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.