Title: Git Fixes Six Flaws Including RCE Through Recursive Cloning of a Malicious Repository
Summary:
On November 10, 2026, the Git project released patched versions closing six vulnerabilities, the headline one being CVE-2026-111760: an integer truncation in Git’s index handling that lets an extremely long path pass validation under one name and then be written under a shorter one. An attacker can use that discrepancy to replace a submodule’s .git file with a symbolic link pointing at a directory holding malicious hooks or configuration, and when Git subsequently uses that directory, attacker-controlled code runs — targeting anyone who recursively clones an untrusted repository together with its submodules. Fixes ship in Git 2.56.1 with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2; the release also closes CVE-2026-113408 (path traversal via a malicious server’s advertised HEAD on empty-clone over protocol v2), CVE-2026-114467 (stack corruption merging tags with more than two GPG signatures), CVE-2026-114469 (out-of-bounds read from binary patches that expand past the ~1 GiB size check), CVE-2026-105437 (heap corruption in very large merges, reachable server-side via git merge-tree when a repo sets a large conflict-marker-size in .gitattributes) and CVE-2026-114466 (fast-import rewrite-submodules-from, rewrite-submodules-to and export-pack-edges features, now rejected unless --allow-unsafe-features is set, that could read or write arbitrary files). GitHub has already patched github.com and Enterprise Cloud, with Enterprise Server fixes in 3.19.15, 3.20.11, 3.21.9 and 3.22.4. Until your distributor ships a fixed Git, avoid recursive clones, merges, binary patches and fast-import streams from sources you do not trust — and update any application that bundles its own copy of Git.
References: