Git 2.56.1 and friends

A maintenance release Git 2.56.1 and others for older maintenance tracks down to maint-2.43 are now available at the usual places.

This is a set of coordinated security fix releases. Please update at your earliest convenience.

The tarballs are found at:

https://www.kernel.org/pub/software/scm/git/

The following public repositories all have a copy of the v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1, v2.55.1, and v2.56.1 tags:

url = https://git.kernel.org/pub/scm/git/git
url = https://kernel.googlesource.com/pub/scm/git/git
url = git://repo.or.cz/alt-git.git
url = https://github.com/gitster/git

Credit for organizing the set of these releases goes to Johannes Schindelin. Credit for finding the vulnerabilities goes to Luke Martin and pwn2addr. Credit for fixing them goes to Toon Claes, Karthik Nayak, and Kaartic Sivaraam. The xdiff hardening is based on a patch by Jeff King, with help from Toon Claes and Christian Couder.

------------------------------------------------------------
Git v2.56.1 Release Notes
=========================

This release merges up the fix that appears in v2.50.2, v2.51.3, v2.52.1, v2.53.1, v2.54.1 and v2.55.1 to address CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437; see the release notes for these versions for details.

------------------------------------------------------------
Git v2.50.2 Release Notes
=========================

This addresses the security issues CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469 and CVE-2026-105437.

This release also backports fixes necessary to let the CI builds pass successfully.

Fixes since v2.50.1
-------------------

* CVE-2026-111760:

Recursive clones are susceptible to Remote Code Execution: an attacker-controlled repository can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.

See <https://github.com/git/git/security/advisories/GHSA-vp2w-7xxj-jvxr>
for details.

* CVE-2026-113408:

It is possible for a server to advertise an unborn HEAD that contains path-traversal characters (e.g., refs/heads/../../../TARGET). With the files ref backend that can lead to ref-updating actions to write to unwanted files.

See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.

* CVE-2026-114467:

When Git strips the GPG signatures from a commit message, it only accounts for two signatures. A commit message containing more than two signatures therefore causes a stack memory corruption.

This can be triggered when using git merge with a tag which contains more than two signatures. As such, this makes way for a DoS attack which can potentially also affect forges when such a tag is pushed to a remote and a merge action is initiated.

See <https://gitlab.com/gitlab-org/git/-/work_items/810> for details.

* CVE-2026-114469:

Git rejects patches larger than ~1 GiB, because its patch application code does not work well with large files. That check, however, only considered the size of the patch as it appears in the input, which for binary patches is much smaller than the size of the file the patch describes, as binary patches are compressed and encoded. A binary patch that inflates to a very large size therefore slipped past the check and crashed Git with an out-of-bounds read.

See <https://gitlab.com/gitlab-org/git/-/work_items/811> for details.

* CVE-2026-105437:

When merging, Git computes the size of the buffer holding the merge result in a way that can overflow for very large merges, which can be triggered by a large number of conflicts combined with a large conflict-marker-size. The resulting buffer can then be too small, and Git writes past its end (and, before and after that, before its start), corrupting the heap.

See <https://gitlab.com/gitlab-org/git/-/work_items/814> for details.

* CVE-2026-114466:

In response to CVE-2019-1348, fast-import disallows the export-marks feature by default. The features rewrite-submodules-to and rewrite-submodules-from as well as the option export-pack-edges that were introduced in the meantime also allow reading from arbitrary paths, and are therefore now also disallowed by default.

See <https://gitlab.com/gitlab-org/git/-/work_items/812> for details.

* Defense-in-depth: read-cache: reject cache entries with over-long names.

* Various fix-ups on HTTP tests.

* Test update.

* HTTP Header redaction code has been adjusted for a newer version of cURL library that shows its traces differently from earlier versions.

* The imap-send command was adjusted to work with OpenSSL 4.0.

* Replace macos-13 used at GitHub CI with macos-14, and macos-14 with macos-15.

* Work around a bug in the iconv library shipped with macOS 14 and 15 that fails to correctly handle stateful ISO/IEC 2022 encoded strings.

* ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1).

* ci(dockerized): raise the PID limit for private repositories.

* ci: bump debian-11 job to debian-12.

* ci: skip CVS and P4 tests in leaks job, too.

* mingw: drop the -D_USE_32BIT_TIME_T option, stop using nedmalloc, and only use -Wl,--large-address-aware for 32-bit builds.

* Update GitHub Actions jobs to avoid warnings against using deprecated version of Node.js.

----------------------------------------------------------------

Changes since v2.56.0 are as follows:

Beat Bolli (3):
imap-send: use the OpenSSL API to access the subject alternative names
imap-send: use the OpenSSL API to access the subject common name
imap-send: move common code into function host_matches()

Colin Stagner (1):
ci: ubuntu: use GNU coreutils for dirname

Collin Funk (4):
global: constify some pointers that are not written to
gpg-interface: remove an unnecessary NULL initialization
bloom: remove a misleading const qualifier
dir: avoid -Wdiscarded-qualifiers in remove_path()

Elijah Newren (1):
read-cache: reject cache entries with over-long names

Jeff King (30):
revision: make handle_dotdot() interface less confusing
convert: add const to fix strchr() warnings
http: add const to fix strchr() warnings
transport-helper: drop const to fix strchr() warnings
pager: explicitly cast away strchr() constness
run-command: explicitly cast away constness when assigning to void
pseudo-merge: fix disk reads from find_pseudo_merge()
rev-parse: simplify dotdot parsing
skip_prefix(): check const match between in and out params
revision: avoid writing to const string for parent marks
pkt-line: make packet_reader.line non-const
rev-parse: avoid writing to const string for parent marks
range-diff: drop const to fix strstr() warnings
config: store allocated string in non-const pointer
http: drop const to fix strstr() warning
ref-filter: factor out refname component counting refs/files-backend: drop const to fix strchr() warning
ref-filter: simplify lstrip_ref_components() memory handling
git-compat-util: fix CONST_OUTPARAM typo and indentation
ref-filter: simplify rstrip_ref_components() memory handling
ref-filter: avoid strrchr() in rstrip_ref_components()
ref-filter: clarify lstrip/rstrip component counting find_last_dir_sep(): convert inline function to macro
ci: bump debian-11 job to debian-12
test-lib: allow lazy prerequisite snippets as here-docs
t5551: handle trailing slashes in expected cookies output
t5563: add missing end-of-line in HTTP header
revert: initialize const value
curl: add support for curl_global_trace() components
http: handle curl stripping creds from effective url

Johannes Schindelin (19):
ci(dockerized): raise the PID limit for private repositories
ci: work around Debian 12's HTTP/2 authentication failures ci(vs-build): adapt to Visual Studio 2026 default on windows-latest
mingw: drop the -D_USE_32BIT_TIME_T option
mingw: stop using nedmalloc
mingw: only use -Wl,--large-address-aware for 32-bit builds
t5564: use a short path for the SOCKS proxy socket
checkout: use size_t and st_add() for cache entry length in update_some()
read-cache: use size_t and st_add() for cache entry size in read_one_entry_opt()
cmake: stop trying to build the reftable and xdiff libraries
t1600-index: add expensive tests for over-long tree paths ci(vs-build) make the VS-built git.exe adjust MSYSTEM/PATH
Git 2.50.2
Git 2.51.3
Git 2.52.1
Git 2.53.1
Git 2.54.1
Git 2.55.1
Git 2.56.1

Junio C Hamano (2):
GitHub CI: macos-13 images are no more
ci: skip CVS and P4 tests in leaks job, too

Kaartic Sivaraam (3):
git-compat-util: add st_add5() helper to detect size_t overflow
xdiff: use size_t for merge buffer size computations
xdiff: check for overflow when computing merge buffer size

Karthik Nayak (8):
base85: cleanup unused debug code
base85: introduce a new chunk_and_encode85() function
test-tool: add command to encode-chunk base85
apply: reject binary patches greater than MAX_APPLY_SIZE
apply: add tests mismatch in binary patch size
commit: rewrite remove_signature() to work with multiple signatures
fast-import: add safeguard around rewrite-submodules features
fast-import: add safeguard around 'export-pack-edges'

Patrick Steinhardt (15):
build: tolerate use of _Generic from glibc 2.43 with Clang
ci: fix broken jobs on Ubuntu 25.10 caused by switch to sudo-rs(1)
t7528: work around ETOOMANY in OpenSSH 10.1 and newer
meson: simplify iconv-emits-BOM check
meson: detect broken iconv that requires ICONV_RESTART_RESET
gitlab-ci: update to macOS 15 images
README: add GitLab CI badge to make it more discoverable
t0021: skip EXPENSIVE test that is broken without SIZE_T_IS_64BIT
t4141: fix inefficient use of dd(1)
t5608: reduce maximum disk usage
t7508: skip EXPENSIVE test that is broken without SIZE_T_IS_64BIT
t7900: clean up large EXPENSIVE repository
t: use test_bool_env to parse GIT_TEST_LONG
gitlab-ci: disable RAM disk on macOS jobs
gitlab-ci: enable "GIT_TEST_LONG"

Paul Tarjan (1):
t7800: fix racy "difftool --dir-diff syncs worktree" test

René Scharfe (2):
macOS: make Homebrew use configurable
macOS: use iconv from Homebrew if needed and present

Tamir Duberstein (2):
t4205: compare huge output without diff
ci: use twice the CPU count on both providers

Toon Claes (6):
meson: ignore subprojects/.wraplock
meson: only detect ICONV_OMITS_BOM if possible
meson: use is_cross_build() where possible
connect: validate unborn HEAD symref-target in protocol v2
connect: validate born ref symref-target in protocol v2
connect: validate ref names in protocol v2 ls-refs response

Torsten Bögershausen (2):
utf8.c: prepare workaround for iconv under macOS 14/15 utf8.c: enable workaround for iconv under macOS 14/15

Many thanks to all for the effort, including Junio.

FWIW, this and the other GitLab work item links appear to be inaccessible to normal users. I'm guessing that's not the intent.

I added Patrick to the Cc as one of the folks who may be able to poke the right folks at GitLab to open them up?

Cheers and thanks again,

Todd

Hi Todd,

Indeed. Thank you all for the efforts!

Thank you for pointing it out. It was indeed not the intention. Those work items are accessible now.

Sivaraam