CVE-2026-105437: Heap-based Buffer Overflow in Git
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-11 15:49 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository’s info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.
Description quoted from the CVE record (assigned by GitLab, published 2026-11-10).
Weakness: CWE-122: Heap-based Buffer Overflow
How it can be exploited
Exploitable over the network with high attack complexity needing no privileges and a user must take an action. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Public exploit evidence (Exploit Observer)
Exploit Observer found 1 code repository naming this CVE.
Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.
See all 3 references on Exploit Observer
Live scores
- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- No public rule yet
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| Git | before 2.49.1 from 2.50.0-rc0 before 2.50.2 from 2.51.0-rc0 before 2.51.3 from 2.52.0-rc0 before 2.52.1 from 2.53.0-rc0 before 2.53.1 from 2.54.0-rc0 before 2.54.1 from 2.55.0-rc0 before 2.55.1 from 2.56.0-rc0 before 2.56.1 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Fixed versions stated in the CVE record: 2.49.1, 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1.
How to detect it
There is no open VEDAS detection rule for this bug yet. It is listed on the detection gaps page if CISA has confirmed attacks.
Advisories on this CVE
- GitHub Blog reports Git 2.56.1 fixes six security flaws (full advisory)
References
Exploit code
- HackerOne Bug Bounty Report #4044249 (technical-description, exploit, permissions-required)
Other references
- https://gitlab.com/gitlab-org/git/-/work_items/814
- https://gitlab.com/gitlab-org/gitlab/-/work_items/632121
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.
Supporting partners
