Git 2.56.1 fixes six security vulnerabilities in recursive clones, merges, patches and fast-import
On November 10 the Git project shipped Git 2.56.1 together with patched releases 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2. The updates close six vulnerabilities, announced on the GitHub Blog, that touch recursive clones, reference handling, merges, binary patches and fast-import streams.
Read the original on GitHub Blog — Git security vulnerabilities announced ↗
Why it matters
The most serious bug, CVE-2026-111760, lets a crafted repository run attacker code during a recursive clone by abusing a path-length truncation in the index. Other flaws allow writes outside the reference directory when cloning an empty repository from a malicious server, stack or heap corruption during merges, and crashes from oversized binary patches. GitHub has already patched github.com and GitHub Enterprise Cloud.
What changes
- For developers
- Upgrade to Git 2.56.1 or the fixed release of your series, and update tools that bundle their own Git. Until then, avoid recursive clones, merges, binary patches and fast-import streams from untrusted sources.
- For businesses
- Teams running GitHub Enterprise Server should move to 3.19.15, 3.20.11, 3.21.9 or 3.22.4, and patch Git on CI runners and services that process repositories for users.
Sources
- GitHub Blog — Git security vulnerabilities announced ↗ github.blog Primary source
Summarized by AI from official sources on November 11, 2026. Spotted a mistake? Let us know. How it works