Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2 maintenance releases have been published, eliminating 6 vulnerabilities. The most dangerous vulnerability (CVE-2026-111760) allows code execution when using a command “git clone” in “–recurse-submodules” mode with attacker-controlled repositories.
The problem is caused by the fact that the length of the name entry in the index is calculated using the 64-bit integer type size_t, and is stored in the 32-bit field ce_namelen. When passing a very long name like “.gitA/AAA….”, the value is truncated and the attacker can achieve the length being kept at 4 bytes. As a result, when checking the value, the actual data is used, and when performing the write operation, a truncated version of “.git” is used, which allows an attacker to replace the “.git” file in the submodule with a symbolic link pointing to the directory with settings and hooks.
Other vulnerabilities:
- CVE-2026-113408 – refs/ directory traversal by passing a symbolic link with the value “refs/heads/../../../TARGET” as a HEAD branch when cloning an empty repository using the Git v2 protocol. A subsequent execution of “git commit” will create a TARGET file at the root of the repository, which can be used to overwrite files in the repository.
- CVE-2026-114467 – stack overflow when removing GPG signatures, which could potentially lead to arbitrary execution code. The problem is caused by the fact that the remove_signature() function stores signature positions in a fixed array that can hold a maximum of two signatures. When merging a tag with three or more signatures, the data is stored outside the array.
- CVE-2026-114469 – when checking the size limits of binary patches, data was taken into account before decompressing the compressed data, which led to reading content from an area outside the buffer boundaries.
- CVE-2026-105437 – memory corruption when performing large merge operations due to accumulation of the result size in an int field. In a GitLab configuration with the Gitaly service, the vulnerability can be exploited to execute code (problem blocked in GitLab 19.5.4).
- CVE-2026-114466 – reading and creating arbitrary files in the FS via the “git fast-import” command due to some new fast-import capabilities not falling under the restrictions added to eliminate the old vulnerability CVE-2019-1348.