The Git project released new versions on 10 November 2026 to fix six security vulnerabilities, GitHub said in a post by Elijah Newren. The fixes are in Git 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. CVE-2026-111760: an integer truncation in index handling lets an extremely long path pass validation under one name and be written under a shorter one; an attacker can replace a submodule's .git file with a symbolic link to a directory holding malicious configuration or hooks, so a recursive clone can run attacker-controlled code.

CVE-2026-113408: when cloning an empty repository over protocol v2, a malicious server can advertise a HEAD symref with path-traversal components; with the files reference backend a later branch update can write outside the reference directory. CVE-2026-114467: a tag with more than two GPG signatures can corrupt the stack when merged, with potential denial of service; hosting services that merge on users' behalf can also be affected.

CVE-2026-114469: a small compressed binary patch can bypass the size check and cause an out-of-bounds read that crashes Git. CVE-2026-105437: a size overflow in large merges can corrupt heap memory, affecting services that merge untrusted content and local merges. CVE-2026-114466: three git fast-import stream features (rewrite-submodules-from, rewrite-submodules-to, export-pack-edges) could read arbitrary files or create or append to files; they are now rejected from the stream unless --allow-unsafe-features is set.

GitHub says it has deployed fixes on github.com and GitHub Enterprise Cloud, and GitHub Enterprise Server updates are 3.19.15, 3.20.11, 3.21.9 and 3.22.4.

The post gives no CVSS scores and reports no exploitation. (source: GitHub blog)