The popular version control system project Git has announced the release of new versions that address six multiple security vulnerabilities affecting recursive cloning operations, reference handling, merge operations, binary patch application, and fast-import sensors. These updates provide essential protection for developers and platforms that rely on the system for code management.
Details of Key Security Vulnerabilities
The addressed list includes a vulnerability coded CVE-2026-111760, which allows for arbitrary code execution during recursive cloning of malicious repositories due to integer truncation in index processing. Additionally, CVE-2026-113408 was identified, involving path traversal via a declared header on a server using the version two protocol, as well as CVE-2026-114467, which involves heap memory corruption when removing multiple GPG signatures.
The list also included CVE-2026-114469, related to out-of-bounds reads when processing compressed binary patches, and CVE-2026-105437, which causes dynamic memory corruption during large-scale merge operations. Furthermore, the update addressed CVE-2026-114466, associated with unauthorized access to the file system via fast-import streams through previously unrestricted features.
Available Updates and Versions
The fixes are primarily available in version Git 2.56.1, with backported updates provided for previous generations, including versions 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. The project recommends that developers and system administrators update immediately to the patched version or rely on the updates specific to the maintenance series being used.
What Changes Practically?
Practically, the update imposes strict new checks on index path lengths, declared reference names, and uncompressed patch sizes, preventing the exceeding of safe memory limits or the writing of unintended files. For its part, the GitHub platform has deployed the fixes across its infrastructure and updated services such as GitHub Enterprise Server, GitHub Desktop applications, and Copilot.
The update process remains the most effective means of protection, with the necessity to avoid cloning untrusted repositories or merging content from unknown sources temporarily in the event that an immediate update is not possible.