CVE-2026-111760 is an integer truncation in how Git handles its index that can allow a malicious repository to run code on a machine that performs a recursive clone, together with its submodules.
CVE-2026-111760: how the flaw works
The flaw arises when an extremely long path in a repository passes Git's safety check but is then written to disk under a shorter name. An attacker can craft that shorter name to be .git, allowing the attacker to replace a submodule's .git file with a symbolic link to a folder they control. Because Git refuses to replace a .git folder with a symbolic link, the attack depends on the fact that in a freshly cloned submodule .git is a file. Once Git uses the linked folder, hooks or configuration placed there can run — and hooks are programs Git runs at set points — giving the attacker's code execution on the target machine.
Git project: patches and versions
The Git project released fixes this week in Git 2.56.1 and provided matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The fixed versions refuse extremely long paths before their length can be truncated and exploited.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadGitHub: rollout, guidance, and product updates
GitHub published a detailed write-up of the fixes and said it has applied them to github.com and GitHub Enterprise Cloud. For GitHub Enterprise Server the fixes are included in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4. GitHub said fixed versions of GitHub Desktop and the GitHub Copilot app are being prepared, and that GitHub Codespaces and GitHub Actions will also get the fixed Git.
GitHub advised installing a fixed Git from your operating system or Git distributor and updating any application that ships its own copy of Git. Until a fixed version is installed, GitHub suggested these mitigations: clone only from servers you trust; do not recursively clone repositories you do not trust; do not merge content or tags you do not trust; and do not process binary patches or fast-import streams from sources you do not trust.
Other CVEs fixed in the same releases
- CVE-2026-113408: When someone clones an empty repository over Git protocol v2, a malicious server can send a branch name that contains path traversal. With the files reference backend, a later update to that branch can then write outside Git's reference folder.
- CVE-2026-114467: Merging a tag that carries more than two GPG signatures corrupts Git's stack memory and can cause a denial of service. Hosting services that run such merges for users may also be affected.
- CVE-2026-114469: A binary patch that expands to a very large size can get past Git's patch size limit of about 1 GiB and crash Git with an out-of-bounds read.
- CVE-2026-105437: A very large merge, with many conflicts and a large conflict-marker-size attribute, can make Git write past the end of a buffer that is too small, corrupting heap memory.
- CVE-2026-114466: Three git fast-import features — rewrite-submodules-from, rewrite-submodules-to and export-pack-edges — could be used to read arbitrary files or to create files and add data to them. Git now rejects them in an input stream unless --allow-unsafe-features is set.
GitLab, which assigned CVE-2026-105437, said code-hosting servers are most likely to be targeted through git merge-tree. The conflict-marker-size attribute can be set in a .gitattributes file committed to a repository; if a server reads attributes from the repository, any user who can push branches and open a pull or merge request can trigger the flaw. As a workaround for servers that cannot upgrade yet, GitLab suggested adding conflict-marker-size=7 to each repository's info/attributes file or turning off those merge checks for untrusted repositories.
Short-term mitigations for Windows users, hosts and developers
Not every distribution had shipped an updated client immediately: Git for Windows had not released a version based on Git 2.56.1 as of Tuesday at 19:09 UTC, a check of its release tags by The Hacker News found. That timing note underscores the practical gap between an upstream fix and its availability in platform-specific packages and applications that bundle Git.
Until fixed packages and app updates are available, the guidance from GitHub — clone only from servers you trust; avoid recursive clones of untrusted repositories; do not merge untrusted content or tags; and do not process binary patches or fast-import streams from untrusted sources — is the set of steps organizations and developers were told to follow.
The record in this incident is straightforward: upstream Git has issued fixes across current supported series and hosting and tooling vendors are rolling updates through services and products. The immediate questions for operators are which distributions and applications in their environments still bundle an unpatched Git, and how quickly those vendors can ship updates to eliminate the attack window created by path truncation and submodule handling.
