A Git recursive clone of a malicious repository can run attacker-controlled hooks or configuration. This checklist shows how to patch local machines, automation, Git for Windows, and apps that bundle Git, and when to stop recursive clones of untrusted sources. The fixes shipped on November 10, 2026; one workstation upgrade does not cover every copy that still clones on your behalf.
Updated November 11, 2026
Key Takeaways
- Update to Git 2.56.1 or your series backport before any untrusted recursive clone.
- Patch bundled Git in apps and automation, not only the local install.
- Until patched, skip untrusted recursive clones, merges, binary patches, and fast-import.
- GitHub Enterprise Server fixes are 3.19.15, 3.20.11, 3.21.9, and 3.22.4.
What should you check first?
Inventory every Git that can clone, merge, or import. The GitHub Blog announcement puts the fixes in Git 2.56.1, with backports to 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Junio C Hamano’s announcement also covers maintenance tracks down to maint-2.43.
CVE-2026-111760 is the clone blocker. Integer truncation lets an extremely long path pass validation under one name and be written under a shorter one, so an attacker can replace a submodule’s .git file with a symbolic link pointing to a directory that contains malicious configuration or hooks. When Git later uses that directory, a recursive clone can run attacker-controlled code. The fix rejects those over-long index paths before truncation.
How do you patch every Git recursive clone path?
Match each install to a patched target below, including apps and services that carry their own Git.
| Where Git runs | Patched target |
|---|---|
| Current series | 2.56.1 |
| Older maintenance series | 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, 2.50.2 |
| Git for Windows | 2.56.1 (v2.56.1.windows.1) |
| GitHub Enterprise Server | 3.19.15, 3.20.11, 3.21.9, 3.22.4 |
- Install Git 2.56.1, or the patched release for your maintenance series, from your operating system or Git distributor.
- On Windows, install Git for Windows 2.56.1. It ships Git v2.56.1, addresses all six CVEs, and follows v2.56.0(4) from October 26, 2026.
- Update applications that include their own copy of Git. A current system package does not replace that private binary.
- Update Git used by automation and by services that process repositories on behalf of users.
- Upgrade GitHub Enterprise Server to 3.19.15, 3.20.11, 3.21.9, or 3.22.4. Fixes are already deployed on github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency.
- Track GitHub Desktop and the GitHub Copilot app separately; patched releases are being coordinated. Codespaces and Actions will receive patched Git.
- If you build from source, use the v2.56.1 tag or the matching backport. Tarballs are at kernel.org.
Vendored Git is easy to miss. As with Node2Shell moving past Node.js, find each private copy and replace it.
When should you refuse a recursive clone?
If you cannot update immediately, shrink what that Git may fetch. Help Net Security quoted Elijah Newren, Staff Software Engineer at GitHub:
If you cannot update immediately, clone only from trusted servers and avoid recursive clones of untrusted repositories. Avoid merging untrusted content or tags, or processing binary patches or fast-import streams from untrusted sources. These precautions do not replace installing the fixes.
Apply that hold to any recursive clone of an untrusted repository, and lift it only after the binary doing the clone is patched.
What other untrusted input should you block?
The other five fixes ride in the same releases. Until every copy is on one of them, refuse these inputs.
- Empty protocol v2 clones (CVE-2026-113408). A server can advertise an unborn HEAD with path-traversal components. With the files reference backend, a later branch update can write outside the reference directory.
- Untrusted merges and tags. Stripping more than two GPG signatures can corrupt stack memory, including on forges that merge such a tag (CVE-2026-114467). A very large merge, with many conflicts and a large conflict-marker-size, can overflow the buffer calculation and corrupt the heap (CVE-2026-105437).
- Binary patches (CVE-2026-114469). The roughly 1 GiB check covered only the supplied patch, so a compressed binary patch can expand and cause an out-of-bounds read.
- Untrusted fast-import (CVE-2026-114466). rewrite-submodules-from and rewrite-submodules-to can read arbitrary files; export-pack-edges can create or append to files. They are rejected unless you pass –allow-unsafe-features for a generator you trust.
What should platform teams still treat as open?
Analysis: call the exposure closed only when local Git, Git for Windows, Enterprise Server, automation, and every bundled binary match a release from this set. Retire the temporary clone limits once those copies are patched.
Frequently asked questions
Which Git versions fix code execution during a recursive clone?
Git 2.56.1 includes the fix, with backports in 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3, and 2.50.2. Maintenance tracks down to maint-2.43 were also released.
What if you cannot update Git immediately?
Clone only from trusted servers and avoid recursive clones of untrusted repositories. Also skip untrusted merges, tags, binary patches, and fast-import streams; those steps do not replace the fixes.
Has GitHub already deployed the Git fixes?
Yes, on github.com, GitHub Enterprise Cloud, and GitHub Enterprise Cloud with data residency. Enterprise Server still needs 3.19.15, 3.20.11, 3.21.9, or 3.22.4.
When is –allow-unsafe-features acceptable?
Only when you trust the program generating the fast-import stream. Otherwise Git rejects rewrite-submodules-from, rewrite-submodules-to, and export-pack-edges in that stream.
