The Git project has released Git 2.56.1 to fix six security vulnerabilities, including one that lets a malicious repository run an attacker's code when a developer clones it recursively. The update was announced on 10 November 2026, with backports for the 2.50 to 2.55 lines, and users should update Git and any application that bundles it.

The most serious flaw

The worst of the six, tracked as CVE-2026-111760, comes from an integer truncation in Git's index handling. An extremely long path can pass validation under one name and then be written to disk under a shorter name, so an attacker can replace a submodule's .git file with a symbolic link to a directory holding malicious configuration or hooks. When Git later uses that directory, it can execute the attacker's code during a recursive clone. The fix rejects such long paths.

Five more flaws fixed

The release also closes CVE-2026-113408, a path traversal flaw in which a malicious server abuses the HEAD reference advertised when cloning an empty repository. CVE-2026-114467 is stack corruption triggered by stripping more than two GPG signatures from a message, for example by merging a tag. CVE-2026-114469 allows out-of-bounds reads when applying binary patches, because compressed patches can expand beyond the size check. CVE-2026-105437 is heap corruption in large merges, and CVE-2026-114466 lets fast-import streams read or create files unless the caller passes --allow-unsafe-features.

What users should do

GitHub has deployed the fixes across github.com and GitHub Enterprise Cloud; Enterprise Server administrators should move to 3.19.15, 3.20.11, 3.21.9 or 3.22.4. Until updated, clone only from trusted servers and avoid recursive clones of untrusted repositories. The Git project has not reported any exploitation of these flaws in the wild. Read the full advisory on the GitHub Blog, with independent coverage from The Daily Tech Feed.