{"metadata": {"vulnerability": "CVE-2026-105437", "count": 15, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-05T13:05:02.346Z", "date_only": false, "value": "2026-10-05T13:05:02.346Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-105437", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T17:00:00Z", "date_only": false, "value": "2026-11-10T17:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/", "record": "CVE-2026-105437", "field": "creation_timestamp", "uuid": "d1f71cf0-da06-4a94-b2e4-25555405668a", "content": "Today, the Git project is releasing new versions to address six security vulnerabilities. These include arbitrary code execution when recursively cloning a malicious repository, writes to unintended files, and memory corruption when processing merges or binary patches.\n\n\n\n\nThe fixes are included in Git 2.56.1, with backports to Git 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. We recommend updating to Git 2.56.1 or the patched release for your maintenance series, and updating any applications that bundle Git.\n\n\n\n\nVulnerabilities in Git\n\n\n\n\nCVE-2026-111760: Code execution during recursive clones\n\n\n\n\nGit checks paths before writing files into a working tree, including rejecting paths that would overwrite its own repository metadata. However, an integer truncation in Git’s index handling can cause an extremely long path to pass validation under one name and then be written using a shorter name.Collapse comment\n\n\n\n\nAn attacker can use this discrepancy to replace a submodule’s .git file with a symbolic link pointing to a directory containing malicious configuration or hooks. When Git subsequently uses that directory, it can execute attacker-controlled code during a recursive clone.\n\n\n\n\nThe fix rejects extremely long index entry paths before their lengths can be truncated.\n\n\n\n\n[Advisory]\n\n\n\n\nCVE-2026-113408: Path traversal through a server’s advertised HEAD\n\n\n\n\nWhen cloning an empty repository using Git protocol v2, the server can advertise a HEAD symref pointing to an unborn branch (one that has no commits yet). Git did not validate the symref’s target before storing it locally.\n\n\n\n\nA malicious server can supply a name containing path-traversal components. With the files reference backend, a later operation that updates the branch can write outside the intended reference directory.\n\n\n\n\nGit now validates the advertised target before accepting it. The release also validates other reference names and symbolic-reference targets received through protocol v2.\n\n\n\n\n[Advisory]\n\n\n\n\nCVE-2026-114467: Stack corruption when removing signatures\n\n\n\n\nWhen stripping GPG signatures from a message, Git assumed there would be at most two signatures. A specially crafted message containing more than two signatures can cause Git to write past the end of a fixed-size stack array.\n\n\n\n\nThis can be triggered by merging a tag containing more than two signatures, causing memory corruption and a potential denial of service. Hosting services that perform these merges on behalf of users can also be affected.\n\n\n\n\nThe fix removes the fixed-size array and handles messages with any number of signatures.\n\n\n\n\n[Advisory]\n\n\n\n\nCVE-2026-114469: Out-of-bounds reads when applying binary patches\n\n\n\n\nGit rejects patches larger than approximately 1 GiB because its patch application code cannot safely handle larger inputs. However, this check only considered the size of the patch as supplied.\n\n\n\n\nBinary patches are compressed and encoded, so a relatively small patch can expand beyond that limit. A crafted patch can bypass the input-size check and cause an out-of-bounds read, crashing Git.\n\n\n\n\nGit now also checks the declared uncompressed size before processing a binary patch.\n\n\n\n\n[Advisory]\n\n\n\n\nCVE-2026-105437: Heap corruption during large merges\n\n\n\n\nGit’s merge machinery calculates how much memory it needs for a merge result before writing the output. That calculation can overflow when the result is very large, including when many conflicts are combined with a large conflict-marker-size attribute.\n\n\n\n\nThe overflow can cause Git to allocate a buffer that is too small, then write outside it, corrupting heap memory. This affects applications and hosting services that use Git to merge untrusted content, as well as local merges.\n\n\n\n\nThe fix uses size-appropriate types and checked arithmetic, rejecting merges whose output size cannot be represented safely.\n\n\n\n\n[Advisory]\n\n\n\n\nCVE-2026-114466: Filesystem access through fast-import streams\n\n\n\n\ngit fast-import reads a stream of commands to build a repository. Some commands can access files outside the repository, so Git already restricts them when they appear in an untrusted input stream.\n\n\n\n\nThree additional features lacked that protection. The rewrite-submodules-from and rewrite-submodules-to features can read arbitrary files, potentially exposing their contents through error messages. The export-pack-edges option can create files or append data to existing files.\n\n\n\n\nThese features are now rejected when supplied through the input stream unless the caller explicitly enables --allow-unsafe-features. Only enable that option when you trust the program generating the stream.\n\n\n\n\n[Advisory]\n\n\n\n\nAdditional hardening\n\n\n\n\nAlongside these fixes, the release adds overflow checks to related index entry allocations during checkout and tree processing. These checks complement the path-length limits above, preventing allocation sizes from being truncated or overflowing before Git copies a path into memory.\n\n\n\n\nProtecting GitHub users\n\n\n\n\n\n\nWe have deployed fixes for these vulnerabilities across github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency.\n\n\n\n\nUpdates for GitHub Enterprise Server are available in versions 3.19.15, 3.20.11, 3.21.9, and 3.22.4. We recommend that administrators upgrade as soon as possible.\n\n\n\n\nWe are coordinating releases of GitHub Desktop and the GitHub Copilot app that include patched versions of Git.\n\n\n\n\nGitHub Codespaces and GitHub Actions will also receive patched versions of Git.\n\n\n\n\n\nUpdate Git\n\n\n\n\nUpdating is the most effective way to protect against these vulnerabilities. Install a patched version from your operating system or Git distributor, and update applications that include their own copy of Git. Administrators should also update Git installations used by automation and services that process repositories on behalf of users.\n\n\n\n\nIf you cannot update immediately, clone only from trusted servers and avoid recursive clones of untrusted repositories. Avoid merging untrusted content or tags, or processing binary patches or fast-import streams from untrusted sources. These precautions do not replace installing the fixes.\n\n\n\n\n\n\nGet an updated version of Git >\n\n\n\nThe post Git security vulnerabilities announced appeared first on The GitHub Blog.", "url": "https://github.blog/open-source/git/git-security-vulnerabilities-announced-7/"}, {"timestamp": "2026-11-10T18:34:09.369Z", "date_only": false, "value": "2026-11-10T18:34:09.369Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105437", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T18:34:09.369Z", "date_only": false, "value": "2026-11-10T18:34:09.369Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-105437", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T18:34:09.369Z", "date_only": false, "value": "2026-11-10T18:34:09.369Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitLab", "record": "CVE-2026-105437", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T19:17:46Z", "date_only": false, "value": "2026-11-10T19:17:46Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-M7R7-8V36-J77R", "record": "GHSA-M7R7-8V36-J77R", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-10T19:17:46.200Z", "date_only": false, "value": "2026-11-10T19:17:46.200", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105437", "record": "FKIE_CVE-2026-105437", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T19:17:46.200Z", "date_only": false, "value": "2026-11-10T19:17:46.200", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105437", "record": "FKIE_CVE-2026-105437", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-10T20:49:39.860Z", "date_only": false, "value": "2026-11-10T20:49:39.860912Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117594113897252088", "record": "CVE-2026-105437", "field": "creation_timestamp", "uuid": "db2b9cac-0db8-4cb7-ba57-a32da9e61f91", "content": "#Git  vulnerabilities announced:\n- CVE-2026-111760: Code execution during recursive clones- CVE-2026-113408: Path traversal through a server\u2019s advertised HEAD- CVE-2026-114467: Stack corruption when removing signatures- CVE-2026-114469: Out-of-bounds reads when applying binary patches- CVE-2026-105437: Heap corruption during large merges- CVE-2026-114466: Filesystem access through fast-import streams\nhttps://github.blog/open-source/git/git-security-vulnerabilities-announced-7/\n#infosec #cybersecurity", "url": "https://infosec.exchange/users/harrysintonen/statuses/117594113897252088"}, {"timestamp": "2026-11-10T21:32:18Z", "date_only": false, "value": "2026-11-10T21:32:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-M7R7-8V36-J77R", "record": "GHSA-M7R7-8V36-J77R", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T21:32:18Z", "date_only": false, "value": "2026-11-10T21:32:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-M7R7-8V36-J77R", "record": "GHSA-M7R7-8V36-J77R", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T21:55:39.964Z", "date_only": false, "value": "2026-11-10T21:55:39.964536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzygltpjcb2a", "record": "CVE-2026-105437", "field": "creation_timestamp", "uuid": "5de156d4-d080-42ae-893d-a9a58b49081b", "content": "Update self-managed servers to 19.5.4 now to fix the critical GitLab heap overflow flaw CVE-2026-105437 that allows command execution in Gitaly.\n\n#GitLab #GitSecurity #DevSecOps #Cybersecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzygltpjcb2a"}, {"timestamp": "2026-11-10T23:10:50.428Z", "date_only": false, "value": "2026-11-10T23:10:50.428607Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mzyksajat62q", "record": "CVE-2026-105437", "field": "creation_timestamp", "uuid": "154b2eb2-e498-4700-9a64-0a7971fee8da", "content": "Update to Git 2.56.1 now to fix six Git security vulnerabilities, including CVE-2026-111760 and CVE-2026-105437 for code execution and heap bugs.\n\n#Git #GitHub #DevSecOps #Cybersecurity #InfoSec", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mzyksajat62q"}, {"timestamp": "2026-11-10T23:23:30.057Z", "date_only": false, "value": "2026-11-10T23:23:30.057050Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jmm86.bsky.social/post/3mzylivja4p2v", "record": "CVE-2026-105437", "field": "creation_timestamp", "uuid": "cfebf345-b872-4ed5-aaf1-9c0534ccf8dc", "content": "Update to 19.5.4 fixes CVE-2026-105437, but verify your versioning isn't already patched and monitor for any regression in heap safety before committing.", "url": "https://bsky.app/profile/jmm86.bsky.social/post/3mzylivja4p2v"}, {"timestamp": "2026-11-11T09:28:11.498Z", "date_only": false, "value": "2026-11-11T09:28:11.498163Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117597096563470001", "record": "CVE-2026-105437", "field": "creation_timestamp", "uuid": "98762f27-bb9a-437d-a1a8-9908f2da8701", "content": "CVE-2026-105437 Heap-based Buffer Overflow in Git Affected versions of Git have a heap buffer overflow in the three-way mergecode (xdiff), which an attacker can trigger through a repository theycontrol.\nWhen Git merges a file, it first adds up the size of the mergedoutput, allocates a buffer of that size, and then writes the output intoit. That total was kept in a 32-bit signed integer. Theconflict-marker-size attribute, which can be set from a committed.gitattributes file, accepts any positive integer, and the markers arewritten several times for every conflict. A small file with a huge markersize and many separate conflicts can therefore push the total past 4 GiB,so the integer wraps to a small value and Git writes attacker-controlledmerge output past the end of a buffer that is too small. At minimum thiscrashes Git, and because the overflow is large and its contents are largelyattacker-controlled, worse heap corruption is possible.\nAny command that does a textual three-way merge can trigger it, suchas git-merge(1), git-rebase(1), git-cherry-pick(1), andgit-merge-tree(1). The latter is most likely a target for Git forges,which might use git-merge-tree(1) on the server-side to checkmergeability. When the server reads attributes from trees in therepository (for example through attr.tree or --attr-source), anyuser who can push branches and request that they be merged (forexample by opening a pull or merge request) can trigger the overflowwithout anyone else doing anything, and the data they push is smallbecause the oversized output only appears during the merge.\nThe problem has been patched by computing the size as size_t andchecking every addition for overflow, so Git stops with an errorinstead of overflowing.\nServers that cannot upgrade right away can add\n* conflict-marker-size=7\nto each repository's info/attributes as a workaround, which overridesany in-tree .gitattributes, or turn off server-side mergeability checks foruntrusted repositories.\nhttps://www.cve.org/CVERecord?id=CVE-2026-105437https://gitlab.com/gitlab-org/git/-/work_items/814https://gitlab.com/gitlab-org/gitlab/-/work_items/632121https://hackerone.com/reports/4044249#Git#CVE_2026_105437#bot", "url": "https://infosec.exchange/users/cve/statuses/117597096563470001"}], "metrics": {"as_of": "2026-11-11T10:52:40.639Z", "anchors": {"origin": {"timestamp": "2026-11-10T18:34:09.369Z", "date_only": false, "value": "2026-11-10T18:34:09.369Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105437", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T18:34:09.369Z", "date_only": false, "value": "2026-11-10T18:34:09.369Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105437", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 58711.27051, "hours": 16.30868625277778, "days": 0.6795285938657407, "min_seconds": 58711.27051, "max_seconds": 58711.27051, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T18:34:09.369Z", "date_only": false, "value": "2026-11-10T18:34:09.369Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105437", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T10:52:40.639Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}