# Git releases security updates to address six vulnerabilities including code execution

> **Key takeaway:** Git has released several patched versions to fix critical vulnerabilities ranging from arbitrary code execution during recursive clones to heap and stack memory corruption.

**Published:** 2026-11-10T18:00:00+00:00 
**Source:** GitHub Open Source & Sponsors Blog 
**Category:** policy-community 
**Canonical URL:** https://fosswire.org/news/git-releases-security-updates-to-address-six-vulnerabilities.html 

## Summary
The Git project has announced a series of security updates to address six distinct vulnerabilities affecting various aspects of the version control system. These flaws include risks of arbitrary code execution, path traversal, and memory corruption during operations such as merging, applying binary patches, or cloning repositories.

To mitigate these risks, Git 2.56.1 has been released as the primary patched version. For users on older maintenance branches, backports are available in versions 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Developers and system administrators are urged to update their local installations and ensure that any applications or hosting services bundling Git are also updated.

## Technical breakdown of Git vulnerabilities
- **Arbitrary Code Execution (CVE-2026-111760):** An integer truncation error in index handling allowed extremely long paths to bypass validation, enabling attackers to use symbolic links to replace submodule .git files with malicious configurations during recursive clones.
- **Path Traversal (CVE-2026-113408):** A flaw in Git protocol v2 allowed malicious servers to advertise a HEAD symref containing path-traversal components, potentially writing files outside the intended reference directory.
- **Memory Corruption (CVE-2026-114467 & CVE-2026-105437):** Git faced stack corruption when stripping GPG signatures due to fixed-size array assumptions, and heap corruption during large merges caused by integer overflows in memory allocation calculations.
- **Out-of-bounds Reads (CVE-2026-114469):** A bypass in the binary patch size check allowed compressed patches to expand beyond the 1 GiB safety limit, leading to out-of-bounds reads and application crashes.
- **Filesystem Access (CVE-2026-114466):** Vulnerabilities in the fast-import stream processing could allow commands to access files outside the boundaries of the repository.

## Why it matters
This update is critical for software engineers, DevOps teams, and hosting providers like GitHub or GitLab, as many of these flaws can be triggered by processing untrusted remote repositories or merge requests. Failure to patch could lead to compromised developer workstations or server-side memory corruption in automated CI/CD pipelines.