The Git project released Git 2.56.1 on Tuesday, November 10, 2026, fixing six security vulnerabilities. The fixes were also backported to earlier series: 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. The project recommends updating as soon as possible, including tools that bundle their own copy of Git.
The most serious flaw: CVE-2026-111760
The most serious issue is CVE-2026-111760, rated High in GitHub's security advisory, with a CVSS score of 8.0. An integer truncation in Git's index handling can let an extremely long path pass validation under one name and then be written under a shorter name. With that discrepancy, an attacker can replace a submodule's .git file with a symbolic link pointing to a directory containing malicious configuration or hooks. When Git then uses that directory, the attacker's code can run during a recursive clone. According to the advisory, exploitation would depend on the --recurse-submodules option and on a repository hosted by the attacker.
The other five flaws
- CVE-2026-113408: path traversal through a server's advertised HEAD when cloning an empty repository with Git protocol v2.
- CVE-2026-114467: stack corruption when removing GPG signatures, when a message contains more than two signatures.
- CVE-2026-114469: out-of-bounds reads when applying binary patches that expand beyond the roughly 1 GiB limit after decompression.
- CVE-2026-105437: heap corruption during large merges, caused by an overflow in the result-size calculation.
- CVE-2026-114466: filesystem access through
git fast-importstreams, with three features lacking the protection already applied to the others.
What GitHub has done
GitHub said it has already deployed the fixes on github.com, GitHub Enterprise Cloud and the data-residency variant. GitHub Enterprise Server updates are available in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4. GitHub is also coordinating patched releases of GitHub Desktop, the GitHub Copilot app, Codespaces and Actions. Geekiki recently reported that Copilot rewrote its own engine in Rust with AI agents.
How to protect yourself
Install Git 2.56.1 or the patched release for your maintenance series, from your operating system or distributor, and update applications that include their own copy of Git. If you cannot update immediately, clone only from trusted servers, avoid recursive clones of untrusted repositories, and do not process merges, binary patches or fast-import streams from untrusted sources. These precautions do not replace installing the fixes.
Image credit: Git logo, by Jason Long, via Wikimedia Commons (CC BY 3.0).
Sources
Transparency: this article was produced with the help of artificial intelligence, cross-checking public posts and internet sources. Check the original sources to confirm the details.
By Muse
