# Git Releases Security Patches Addressing Six Critical Vulnerabilities New patches resolve arbitrary code execution, memory corruption, and path traversal flaws in Git. - **Source:** [The GitHub Blog](https://brifing.si/source/9783c41a-41dd-45e0-8c71-c0930937342d) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/c9227726-aab4-4f3e-b57c-46fde1804d38 ## Critical Security Update Released The Git project has released version 2.56.1 and backported fixes to versions 2.50.2 through 2.55.1 to address six distinct security vulnerabilities. These flaws include risks of arbitrary code execution, memory corruption, and unauthorized file access. Users and developers are strongly advised to update their Git installations and any applications bundling Git. ## Recursive Clone Code Execution CVE-2026-111760 involves an integer truncation flaw during recursive repository cloning. Attackers can exploit this by using extremely long paths to bypass validation, eventually replacing submodule configuration files with malicious symbolic links. This allows the execution of attacker-controlled code, which the new update prevents by rejecting excessively long index entry paths. ## Path Traversal via HEAD A vulnerability tracked as CVE-2026-113408 allows path traversal when cloning empty repositories using Git protocol v2. Malicious servers can advertise a HEAD symref containing traversal components, potentially writing files outside the intended directory. Git now validates all advertised targets and symbolic-reference names before accepting them to prevent unauthorized file system writes. ## Memory Corruption and Signatures CVE-2026-114467 addresses stack corruption occurring when stripping GPG signatures from messages. Previously, Git assumed a maximum of two signatures, causing buffer overflows if more were present. The fix removes this fixed-size array limitation, allowing the software to safely handle messages with any number of signatures, preventing potential denial of service attacks. ## Binary Patch and Merge Risks CVE-2026-114469 and CVE-2026-105437 address out-of-bounds reads and heap corruption. The former occurs when processing compressed binary patches, while the latter involves memory allocation overflows during large merges. Git now validates uncompressed patch sizes and uses size-appropriate types for merge calculations to ensure memory safety during operations involving untrusted content. ## Fast-Import Stream Restrictions CVE-2026-114466 restricts filesystem access within git fast-import streams. Features like rewrite-submodules and export-pack-edges can now read or create arbitrary files if left unprotected. These features are now disabled by default for untrusted streams unless the caller explicitly enables the --allow-unsafe-features flag, providing a necessary layer of defense against unauthorized access. ## GitHub Infrastructure Mitigation GitHub has already deployed these patches across github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server, specific versions ranging from 3.19.15 to 3.22.4 include the fixes. While GitHub Desktop and Copilot updates are in progress, users are encouraged to apply OS-level patches immediately, as temporary workarounds do not replace the necessity of upgrading. ## Proactive Security Maintenance These vulnerabilities highlight the risks inherent in processing untrusted repository data, particularly for code-hosting services. By implementing stricter validation for paths, memory allocation, and input streams, the Git project aims to harden the ecosystem. Organizations should prioritize updating their infrastructure to mitigate potential exploitation of these critical security flaws. ## Sources covering this story - [The GitHub Blog — Git Releases Security Patches for Six Critical Vulnerabilities](https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/) - [The Hacker News — Git Patches Critical Flaw Enabling Malicious Code Execution via Recursive Clones](https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._