Git Fixes Six Security Flaws That Could Let Malicious Repositories Execute Code

Overview

• The Git project released Git 2.56.1 and backports that close six vulnerabilities that let crafted inputs cause code execution, path traversal, memory corruption, crashes, or unauthorized filesystem access.
• One flaw, CVE-2026-111760, uses an integer truncation during recursive clones to allow an attacker to replace a submodule’s .git with a symbolic link that can run attacker-controlled hooks during cloning.
• Other fixes stop a malicious protocol v2 server from advertising path-traversal reference names, prevent stack and heap corruption in large merges or signature stripping, and block unsafe fast-import features from untrusted input streams.
• GitHub has applied service-side mitigations for github.com and Enterprise Cloud, published Enterprise Server updates, and is coordinating patched client and platform builds while vendors that bundle Git must still push updated binaries.
• Operators who cannot upgrade immediately should avoid recursive clones and untrusted merges or fast-import streams, apply repository-level limits like conflict-marker-size, and update CI or hosting Git installations as soon as patched builds arrive.