The Git Project released security updates on 10th October 2026 addressing six vulnerabilities affecting recursive cloning, reference handling, merge operations, binary patch processing, and fast import functionality.

Through our blog, we will understand what vulnerabilities were fixed through the update, their impact on organizations, and which ones to prioritize.

Key vulnerabilities addressed

1. CVE-2026-111760 — Git Code Execution

A path handling flaw caused by integer truncation in Git’s index processing that allows attackers to bypass security checks by exploiting extremely long file paths.

Attackers can exploit this flaw to:

• Execute arbitrary code when a user clones a malicious repository and its submodules.
• Replace Git configuration files with attacker-controlled files.
• Execute malicious Git hooks when Git accesses the compromised directory.
• Cause a compromise of the developer’s local environment through a malicious repository.

2. CVE-2026-113408 — Path Traversal

This flaw arises because Git fails to verify branch information received from a remote server. This allows attackers to provide malicious file paths.

Attackers can exploit this flaw to:

• Write files outside the intended reference directory.
• Modify repository references and compromise a repository’s integrity.
• Overwrite unintended files accessible to the Git process.

3. CVE-2026-114467 — Stack Memory Corruption

This flaw arises because Git is designed to handle just two GPG signatures. When a message contains more than two signatures, Git cannot handle the additional data properly, causing memory overflow.

Attackers can exploit this flaw to:

• Cause Git to crash and create DoS condition.
• Trigger stack memory corruption.
• Cause failure of certain Git operations.

4. CVE-2026-114469 — Out-of-Bounds Reads

This flaw is due to an error in properly checking the size of binary patches after decompression, allowing oversized patches to bypass security checks.

Attackers can exploit the flaw to:

• Force Git to access unauthorized memory locations while processing a malicious patch.
• Cause Git to crash
• Disrupt applications and services that process untrusted binary patches.

5. CVE-2026-105437 — Heap Memory Corruption

This flaw arises because Git incorrectly calculates how much memory it needs when merging very large files.

Attackers can exploit the flaw to:

• Crash Git and prevent developers from completing code merges.
• Disrupt automated software builds, testing, and deployment.
• Interrupt Git hosting services that process repository merges.

6. CVE-2026-114466 — Unsafe File Access

This flaw is because Git’s fast-import functionality does not properly restrict access to files outside the repository when processing untrusted data.

Attackers can exploit this vulnerability to:

• Access confidential files containing credentials or internal information.
• Reveal sensitive data through error messages.
• Tamper with files, potentially disrupt applications, or alter system configurations.

Affected Products:

• Git versions before the applicable patched releases in the 2.50–2.56 maintenance series.
• Applications bundling their own Git implementations.
• Developer workstations and build servers.
• CI/CD environments processing untrusted repositories.

Fixed Versions:

• Git 2.56.1.
• Git 2.55.1.
• Git 2.54.1.
• Git 2.53.1.
• Git 2.52.1.
• Git 2.51.3.
• Git 2.50.2.

SharkStriker recommendations

• Prioritize CVE-2026-111760 due to potential arbitrary code execution.
• Upgrade Git to the applicable patched version.
• Avoid recursively cloning repositories from untrusted sources.
• Validate repository submodule URLs and configurations.
• Secure CI/CD pipelines using isolated build environments.
• Update applications bundling their own Git implementations.
• Validate successful patch deployment across development systems.