GitHub Blog reports Git 2.56.1 fixes six security flaws

What happened

According to the GitHub Blog, in a post by Elijah Newren dated November 10, 2026, the Git project is releasing new versions to address six security vulnerabilities. The blog says they include arbitrary code execution when recursively cloning a malicious repository, writes to unintended files, and memory corruption when processing merges or binary patches GitHub Blog. We found no independent confirmation in the sources, and no report of exploitation in the wild is confirmed.

The blog says the fixes are in Git 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. It recommends updating applications that bundle Git as well GitHub Blog.

The text of the blog post available to us is cut off, so only four of the six issues are described below. The other two are not confirmed here.

• CVE-2026-111760, code execution during recursive clones. The GitHub Blog says an integer truncation in Git’s index handling can let an extremely long path pass validation under one name and be written under a shorter one. It says an attacker can use this to replace a submodule’s .git file with a symbolic link to a directory holding malicious configuration or hooks, which Git may then execute during a recursive clone. The fix rejects extremely long index entry paths before their lengths are truncated.
• CVE-2026-113408, path traversal through a server’s advertised HEAD. The blog says that when cloning an empty repository over protocol v2, Git did not validate the target of the HEAD symref the server advertised. With the files reference backend, a later branch update could write outside the intended reference directory. Git now validates that target, plus other reference names and symbolic-reference targets received over protocol v2.
• CVE-2026-114467, stack corruption when removing signatures. The blog says Git assumed at most two GPG signatures when stripping them from a message. A crafted message with more could write past a fixed-size stack array, for example by merging a tag with more than two signatures. The blog describes memory corruption and a potential denial of service, and says hosting services that perform such merges for users can also be affected. The fix removes the fixed-size array.
• CVE-2026-114469, out-of-bounds reads when applying binary patches. The blog says Git’s roughly 1 GiB patch size limit only checked the patch as supplied, and that a small compressed and encoded binary patch can expand beyond it. The rest of the description is not available in the text we have.

A separate GitHub advisory for the recursive clone issue, published the same day, rates it High with a CVSS score of 8.0 (vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H). It says the issue can be triggered by an attacker-controlled repository, and that it is currently believed to require the --recurse-submodules option GitHub Advisory GHSA-vp2w-7xxj-jvxr.

That advisory page lists affected versions as “all” and patched versions as “none”, and says patches are being discussed on the git-security mailing list. This conflicts with the blog’s statement that fixes are released. The page may be out of date, but the sources do not say. Verify against the official release notes.

Am I affected?

• The advisory for CVE-2026-111760 lists affected versions as “all”. Exact affected version ranges for the other issues are not confirmed in the sources we have.
• The recursive clone issue is described as relevant when cloning an untrusted repository with --recurse-submodules GitHub Advisory GHSA-vp2w-7xxj-jvxr.
• The GitHub Blog says hosting services that perform merges on behalf of users can also be affected by the signature-stripping issue, and that applications bundling Git should be updated GitHub Blog.
• Run git --version and compare it with the fixed releases listed above.

What to do now

1. Update Git to 2.56.1, or to the patched release for your series: 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 or 2.50.2 GitHub Blog.
2. Update any application or tool that bundles its own copy of Git, as the blog recommends.
3. Until you have updated, avoid cloning repositories from untrusted sources, particularly with --recurse-submodules GitHub Advisory GHSA-vp2w-7xxj-jvxr.
4. If you run a service that merges tags or applies patches on behalf of users, check which Git version it uses.
5. Read the full GitHub Blog post and the linked per-issue advisories for the two issues not covered here, and for any details that differ from this summary.

Update, 11 November 2026

• The Hacker News reports that the two other flaws fixed in the Git releases are CVE-2026-105437, a heap buffer overflow when merging with many conflicts and a large conflict-marker-size attribute, and CVE-2026-114466, where the git fast-import features rewrite-submodules-from, rewrite-submodules-to and export-pack-edges could be used to read arbitrary files or to create files and add data to them. (thehackernews.com)
• The Hacker News says Git now rejects those three fast-import features in an input stream unless --allow-unsafe-features is set. (thehackernews.com)
• The Hacker News says GitHub has already applied the fixes to github.com and GitHub Enterprise Cloud, and that GitHub Enterprise Server fixes are in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4. Fixed GitHub Desktop and GitHub Copilot app versions are being prepared. (thehackernews.com)
• The Hacker News reports that Git for Windows had not released a version based on Git 2.56.1 as of Tuesday at 19:09 UTC, based on its check of the project’s release tags. (thehackernews.com)

Update, 10 November 2026

• The Hacker News says GitLab assigned CVE-2026-105437, the merge conflict heap overflow, and that code-hosting servers are most likely to be targeted through git merge-tree. If a server reads attributes from the repository, any user who can push branches and open a pull or merge request could trigger it (The Hacker News).
• For servers that cannot upgrade yet, the outlet reports a workaround for CVE-2026-105437: add conflict-marker-size=7 to each repository’s info/attributes file, or turn off those merge checks for untrusted repositories.
• The outlet says GitHub’s interim mitigations, which do not replace the fixes, are to clone only from trusted servers, avoid recursive clones and merges of untrusted content, and not process untrusted binary patches or fast-import streams.
• It also says GitHub Codespaces and GitHub Actions will get the fixed Git.
• The outlet gives no severity rating or score and does not report any of the flaws being exploited.

Sources

• GitHub Blog: Git security vulnerabilities announced
• GitHub Advisory: Recursive clones are susceptible to Remote Code Execution (GHSA-vp2w-7xxj-jvxr)
• thehackernews.com: Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones