Overview
- The Git project released version 2.56.1 with backports across maintenance series to fix six security flaws that can be triggered by untrusted repositories or servers.
- One flaw, CVE-2026-111760, lets a malicious repo use an integer truncation to turn an extremely long path into a .git entry and run attacker code during recursive clones.
- Other patched bugs include path traversal from a malicious HEAD symref, stack or heap corruption when handling extra GPG signatures or very large merges, and out-of-bounds reads from compressed binary patches.
- GitHub has deployed fixes to github.com and Enterprise Cloud and published Enterprise Server updates while coordinating patched releases of Desktop, Copilot, Codespaces, and Actions.
- Users and admins should update system Git and any bundled Git immediately and, until patches are installed, avoid recursive clones, untrusted merges, processing binary patches, or accepting fast-import streams from untrusted sources.