Git: malicious repositories can run code during recursive clones (CVE-2026-111760)

What happened

On 11 November 2026 the Git project released new versions that fix six security flaws. The most serious one is CVE-2026-111760. Cloning a malicious repository recursively, which means together with its submodules, can run the attacker's code on the machine doing the clone.

The cause is an integer truncation in how Git handles its index. A very long path passes Git's safety check, but Git then writes it to disk under a shorter name. An attacker can choose that shorter name. This lets the attacker replace a submodule's .git file with a symbolic link to a directory that holds malicious hooks or configuration. When Git then uses that directory, the attacker's code runs. The fix makes Git reject such very long paths before their length can be cut short.

The same releases fix five more flaws:

• CVE-2026-113408: When someone clones an empty repository over Git protocol v2, a malicious server can send a branch name that contains path traversal. With the files reference backend, a later update to that branch can write outside Git's reference directory.
• CVE-2026-114467: Merging a tag that carries more than two GPG signatures corrupts stack memory and can cause a denial of service. Hosting services that run such merges for their users can also be affected.
• CVE-2026-114469: A binary patch that expands to a very large size can get past Git's patch size limit of about 1 GiB and crash Git with an out-of-bounds read.
• CVE-2026-105437: A very large merge with many conflicts and a large conflict-marker-size attribute can make Git write past the end of a heap buffer. GitLab says code hosting servers are the most likely targets, through git merge-tree, which servers run to check whether a pull or merge request can be merged.
• CVE-2026-114466: Three git fast-import features (rewrite-submodules-from, rewrite-submodules-to and export-pack-edges) could be used to read arbitrary files, or to create files and add data to them. Git now rejects them in an input stream unless --allow-unsafe-features is set.

None of the sources reports attacks so far.

Who is affected

Affected is every system that runs a Git version from before these fixed releases: 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. On servers, these matter most:

• Build, CI and deployment servers that clone repositories recursively (git clone --recursive, --recurse-submodules, or git submodule update --init), especially repositories or submodules from third parties. For CVE-2026-111760 to work, the cloned repository has to be malicious. If you only clone your own trusted repositories, the risk is much lower, but you should still update.
• Self-hosted Git hosting servers that run merges or merge checks on content pushed by users (CVE-2026-105437, CVE-2026-114467).
• GitHub Enterprise Server: the fixes are in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4.
• Applications that ship their own copy of Git. They need an update from their vendor.

Not affected: github.com and GitHub Enterprise Cloud. GitHub has already applied the fixes there. Web servers that have Git installed but never clone or merge content from outside are not exposed to the clone flaw in practice. Update them anyway during your next maintenance.

Git for Windows had not released a version based on Git 2.56.1 as of 10 November 2026, 19:09 UTC. Windows administrators should watch for that release.

What to do now

1. Check the installed version on each server with git --version.
2. Install a fixed version from your operating system's package manager (for example apt update && apt install --only-upgrade git or dnf upgrade git). Distributions usually backport fixes into their own package versions, so check your distribution's security advisory to find the fixed package. If you build Git yourself, upgrade to 2.56.1 or to the fixed release of your series.
3. Update GitHub Enterprise Server to 3.19.15, 3.20.11, 3.21.9 or 3.22.4, depending on your release line. Update any other applications that ship their own copy of Git once their vendor releases a fix.
4. Until every system is updated, follow GitHub's interim advice. These steps do not replace the update:
   • Clone only from servers you trust.
   • Do not clone repositories you do not trust recursively.
   • Do not merge content or tags you do not trust.
   • Do not process binary patches or fast-import streams from sources you do not trust.
5. On Git hosting servers that cannot be updated yet, protect against CVE-2026-105437. Add conflict-marker-size=7 to each repository's info/attributes file, or turn off merge checks for untrusted repositories.
6. Restart long-running services that call Git, such as CI runners or Git hosting daemons, so they use the new binary.

How to check whether you are affected

• Run git --version. Versions older than the fixed release of their series are affected: 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1 or 2.56.1. For distribution packages, compare the package version with your distribution's advisory instead of the upstream version number.
• Search your build and deployment scripts and CI configurations for --recursive, --recurse-submodules and submodule update. Check which of the repositories they clone come from third parties.
• Look for Git copies outside the package manager, for example with which -a git. Also check the Git bundled with CI runners, containers and other applications.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-111760
• https://thehackernews.com/2026/11/git-patches-flaw-that-lets-malicious.html