Git fixes six flaws, including code execution on recursive clone, and GitLab ships a critical patch

Am I affected: The Git project says the fixes are in Git 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. GitLab says CVE-2026-105437 affects GitLab CE/EE from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4. GitHub.com, GitLab.com, and GitLab Dedicated are already patched.

Do now: Install 2.56.1 or the patched release for your Git series, and update apps that bundle Git. If you self-host an affected GitLab version, upgrade to 19.5.4, 19.4.6, or 19.3.8.

The Git project released new versions on November 10, 2026 to fix six security vulnerabilities. The fixes are in Git 2.56.1, with backports to Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. The announcement recommends updating to 2.56.1 or the patched release for your maintenance series, and updating any applications that bundle Git. The Git post does not give severities or CVSS scores.

The six flaws

• CVE-2026-111760, code execution during recursive clones. An integer truncation in Git's index handling can let an extremely long path pass validation under one name and then be written under a shorter one. An attacker can use this to replace a submodule's .git file with a symbolic link to a directory holding malicious configuration or hooks, which can run attacker-controlled code during a recursive clone.
• CVE-2026-113408, path traversal through a server's advertised HEAD. When cloning an empty repository over Git protocol v2, a malicious server can advertise a HEAD pointing to a branch name with path-traversal parts. With the files reference backend, a later update to that branch can write outside the reference directory.
• CVE-2026-114467, stack corruption when removing signatures. Merging a tag with more than two GPG signatures can write past a fixed-size array, causing memory corruption and a potential denial of service. Hosting services that perform these merges for users can also be affected.
• CVE-2026-114469, out-of-bounds reads when applying binary patches. A small compressed binary patch can expand past Git's roughly 1 GiB limit and crash Git.
• CVE-2026-105437, heap corruption during large merges. A size calculation in Git's merge code can overflow, for example when many conflicts are combined with a large conflict-marker-size attribute, so Git writes outside a too-small buffer. The announcement says this affects applications and hosting services that merge untrusted content, as well as local merges.
• CVE-2026-114466, filesystem access through fast-import streams. Three git fast-import features could read arbitrary files or create and append to files when supplied in an untrusted stream: rewrite-submodules-from and rewrite-submodules-to can read arbitrary files, and export-pack-edges can create files or append data to existing files. They are now rejected unless the caller passes --allow-unsafe-features. The announcement says to enable that option only when you trust the program generating the stream.

GitHub and GitLab

GitHub says it has deployed the fixes across github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency, and that GitHub Enterprise Server updates are available in 3.19.15, 3.20.11, 3.21.9, and 3.22.4. It says it is coordinating patched releases of GitHub Desktop and the GitHub Copilot app, and that GitHub Codespaces and GitHub Actions will also receive patched Git.

GitLab released 19.5.4, 19.4.6, and 19.3.8 the same day as a critical patch release. It rates CVE-2026-105437 critical. That rating is GitLab's. GitLab says that in GitLab, under certain conditions, the bug can cause out-of-bounds heap writes that could be used to execute arbitrary commands within GitLab's Gitaly environment. Affected versions are GitLab CE/EE from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4. GitLab.com and GitLab Dedicated are already patched and need no action. GitLab says its official Linux packages and container images include the patched Git. For self-compiled installations, GitLab says to follow its Update Gitaly steps to rebuild the Git binaries embedded in Gitaly, and also rebuild the Git installation referenced by git.bin_path in config/gitlab.yml from the matching Gitaly stable branch. If that Git comes from your distribution's package instead, GitLab says to upgrade it to 2.56.1 or later, or to a version your distribution has patched for CVE-2026-105437.

GitLab says it released a threat detection named "Git merge-tree child process crash" for self-managed instances. It does not say that exploitation attempts were found. GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, is already running a patched version.

What to do

The Git announcement says updating is the most effective protection: install a patched Git from your operating system or Git distributor, update apps that ship their own Git, and update Git used by automation and services that process repositories for users. If you cannot update right away, it advises cloning only from trusted servers, avoiding recursive clones of untrusted repositories, and not merging untrusted content or tags or processing binary patches or fast-import streams from untrusted sources. It says these precautions do not replace the fixes.