Software security · Git · Original analysis

Git patches six vulnerabilities spanning recursive clones, merges, binary patches and imports

Applications that bundle Git and services processing untrusted repositories also need patches. Avoiding risky inputs is only a temporary mitigation.

By AI Speed Canada · Published · Sources listed below

GitHub wordmark above untrusted repository input, patched Git release and verified deployment panels in an illustrative security update workflow
GitHub wordmark with hostile input, patched Git and deployment verification. Illustrative editorial layout; not an exploit demonstration. Credit: GitHub, Inc.; editorial layout by AI Speed Canada · Public-domain text logo; trademark rights retained. Wordmark placed in a distinct original 1280×720 editorial composition and converted to optimized WebP.

The Git project released patched versions on November 10, 2026 for six security vulnerabilities affecting recursive clones, reference handling, signed-tag merges, binary patches, very large merges and fast-import streams. GitHub’s advisory identifies arbitrary code execution, unintended filesystem access and memory corruption among the possible outcomes. This is a completed security release, not a preview: fixes are in Git 2.56.1 and maintenance versions 2.55.1 through 2.50.2.

Applications that embed Git need their own verified update path.

Untrusted repository content reaches several dangerous paths

CVE-2026-111760 uses an extremely long path to exploit integer truncation, replace a submodule .git file and redirect Git toward attacker-controlled configuration or hooks during a recursive clone. CVE-2026-113408 lets a malicious protocol-v2 server advertise a path-traversing HEAD target for an empty repository, enabling a later reference update outside its intended directory.

Other issues involve more than two signatures in a tag merge, an oversized decoded binary patch, arithmetic overflow during a very large merge and unsafe fast-import features. The affected operations differ, so blocking only recursive clones does not cover the full advisory.

Related sources: GitHub: Git security vulnerabilities announced ↗

Update Git itself and products that bundle it

The fixes ship in Git 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. GitHub also lists Enterprise Server fixes in 3.19.15, 3.20.11, 3.21.9 and 3.22.4. Administrators should update build agents, developer workstations and services that run Git on users’ behalf.

A system package update does not necessarily patch Git embedded in a desktop client, IDE, appliance or container image. Inventory executable versions from each environment and redeploy immutable images rather than relying on a base-image tag to move automatically.

Related sources: GitHub: Git security vulnerabilities announced ↗

Input restrictions help temporarily but do not replace patches

GitHub recommends cloning only from trusted servers and avoiding recursive clones, untrusted merges or tags, binary patches and fast-import streams if immediate patching is impossible. These controls reduce exposure but can be incomplete when automation fetches submodules or accepts repository content indirectly.

Canadian organizations should prioritize CI systems, code-hosting services and shared developer images because one hostile repository can cross trust boundaries. Record the installed version, patch date and verification command. Then test clone, merge and import workflows so emergency upgrades do not silently break production pipelines.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

  1. GitHub: Git security vulnerabilities announced ↗ — Official November 10, 2026 security release overview; six CVEs, patched versions, mitigations and GitHub product status.