Six flaws forced patched Git releases across seven maintenance branches. The worst allows code execution from a recursive clone of a malicious repository, GitHub Blog reports.
Git 2.56.1 carries the fixes, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2, according to the announcement by Staff Software Engineer Elijah Newren.
Recursive clone is the one to patch first.
CVE-2026-111760 exploits integer truncation in index handling, Newren writes, where an extremely long path passes validation under one name and is written under a shorter name. An attacker can swap a submodule .git file for a symlink to malicious config or hooks, then get execution during the recursive clone, so the fix rejects overlong index entry paths.
CVE-2026-113408 needs only a malicious server. When cloning an empty repository over protocol v2, Git stored an advertised HEAD symref without validation, according to the announcement, and a traversal payload could later write outside the refs directory. The release now validates symref targets and other v2 ref names.
The other three memory safety bugs do not need a malicious server, only untrusted content. CVE-2026-114467 corrupts the stack when stripping more than two GPG signatures during a tag merge, CVE-2026-114469 bypasses the roughly 1 GiB patch size check with a compressed binary patch that expands past the limit, and CVE-2026-105437 overflows a merge size calculation and under-allocates the heap buffer, all per the announcement.
CVE-2026-114466 tightens git fast-import, which now blocks rewrite-submodules-from, rewrite-submodules-to and export-pack-edges from an input stream unless the caller passes --allow-unsafe-features, according to the announcement. Do not enable it for streams you do not trust.
Six sounds small against 3,584 CVEs published in the week of Nov. 2 to Nov. 9, with 290 rated critical, per the Cyber-defence.io weekly CVE tracker. The contrast matters because Git ships inside almost every pipeline, while SaaS vendors can patch centrally as BeyondTrust did when it remediated BT26-05 for all Remote Support SaaS customers as of Oct. 9, 2026, per that company.
GitHub says it has deployed fixes on github.com, Enterprise Cloud and data residency regions, with Enterprise Server fixes in 3.19.15, 3.20.11, 3.21.9 and 3.22.4. The counts do not show how many self-hosted runners, desktops and bundled tools still run old Git, and confirmed exploitation would change the read from urgent hygiene to incident response. How many downstream copies still bundle a vulnerable Git?
