Git for Windows 2.56.1
Dear Git users,
I hereby announce that Git for Windows 2.56.1 is available from:
Changes since Git for Windows v2.56.0(4) (October 26th 2026):
This addresses the security issues CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.
Security bug fixes
* CVE-2026-111760:
Recursive clones are susceptible to Remote Code Execution: an attacker-controlled repository can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.
* CVE-2026-113408:
It is possible for a server to advertise an unborn HEAD that contains path-traversal characters (e.g., refs/heads/../../../ TARGET). With the files ref backend that can lead to ref-updating actions to write to unwanted files.
* CVE-2026-114467:
When Git strips the GPG signatures from a commit message, it only accounts for two signatures. A commit message containing more than two signatures therefore causes a stack memory corruption.
This can be triggered when using git merge with a tag which contains more than two signatures. As such, this makes way for a DoS attack which can potentially also affect forges when such a tag is pushed to a remote and a merge action is initiated.
* CVE-2026-114469:
Git rejects patches larger than ~1 GiB, because its patch application code does not work well with large files. That check, however, only considered the size of the patch as it appears in the input, which for binary patches is much smaller than the size of the file the patch describes, as binary patches are compressed and encoded. A binary patch that inflates to a very large size therefore slipped past the check and crashed Git with an out-of-bounds read.
* CVE-2026-105437:
When merging, Git computes the size of the buffer holding the merge result in a way that can overflow for very large merges, which can be triggered by a large number of conflicts combined with a large conflict-marker-size. The resulting buffer can then be too small, and Git writes past its end (and, before and after that, before its start), corrupting the heap.
* CVE-2026-114466:
In response to CVE-2019-1348, fast-import disallows the export-marks feature by default. The features rewrite-submodules-to and rewrite-submodules-from as well as the option export-pack-edges that were introduced in the meantime also allow reading from arbitrary paths, and are therefore now also disallowed by default.
New Features
* Comes with Git v2.56.1.
Git-2.56.1-64-bit.exe | c330c72e10b408cc39994bfefdb63542b0d93d21699325c3e0bd874af8a5a559 Git-2.56.1-arm64.exe | 6fe770b534a459d1158011e6ec0cd8390a3bcf44e542bee9e9a650310e111234 PortableGit-2.56.1-64-bit.7z.exe | 9dd04a608ceb5f6ab32a73709e0ecb159d211da71b697c45ff81f6dd0c6b49c7 PortableGit-2.56.1-arm64.7z.exe | 0dca0d9f760924a7e6752235d7dd6eb1a9b508ee714b6ed15d89252e5a58c5c9 MinGit-2.56.1-64-bit.zip | 4a92850b6e917da4fd010669b614b55dccf5b0ec333a534cc4be4700dfefdafd MinGit-2.56.1-arm64.zip | 96571e442e90523a90e5fd8661b4c4e43bc192910f3c6db938816e6955b4cc8c MinGit-2.56.1-32-bit.zip | e9b2c628c6d3bfc86405568d05979c605ee994172eb232cc4cbc4daf54425829 MinGit-2.56.1-busybox-64-bit.zip | baa40c1b8d5897826f47c2b819156553b89833bc52cb42cdfca7d1f0faeed34a MinGit-2.56.1-busybox-arm64.zip | 42396e389d1b38861fea05edc716b2389e071008c44dd62a53ba05bb85f65494 MinGit-2.56.1-busybox-32-bit.zip | 125c9cb25499e27f66bc5c8357ac74fd4bc8b104ee45054d741aeb2bd0fffe60 Git-2.56.1-64-bit.tar.bz2 | d7d89e69855f00e73d957b513c49538a420c465c84b9d212cf1add400eecdf54 Git-2.56.1-arm64.tar.bz2 | 4a5e1555ac8453033d504930857ec8ba4eef20275d784b4e71df84a3da071afb Git-2.56.1-mingw64.tar.bz2 | 94cd91e7d44a925cbc22da6e21fc8c2582985e885de2a5c3cb6346599c7cf297 MinGit-2.56.1-mingw64.zip | f50f51c81a335b1cbf08c47094bfea1c38f9b23486d880662c480166ef12a793 MinGit-2.56.1-busybox-mingw64.zip | 275b3129c9cea50a91466f7991c43cde345431eaa45a41b1443e8f26fc1437ab PortableGit-2.56.1-mingw64.7z.exe | d23741a1bc1ef914cef238d8d6f2260663ec6bb2f3f6ac0528abeb64d2c3fbc6 Git-2.56.1-mingw64.exe | e5385040aa21c4cea02319368d0891412d0ded64b9ce1da97d21d9ff74a6ab8b
Ciao,
Johannes