Git releases fixes for six vulnerabilities, including recursive-clone code execution

Image: Primary

Published Tuesday, November 10, 2026 · 1:16 PM EST

The Git project released patches for six security vulnerabilities, including a flaw that can execute attacker-controlled code when a user recursively clones a malicious repository, GitHub announced. Fixes are available in Git 2.56.1 and six maintenance releases. The recursive-clone flaw lets an extremely long path pass validation before being shortened during writing, allowing an attacker to replace submodule metadata with a link to malicious configuration or hooks. Other fixes address unintended file access, path traversal and memory corruption during merges or binary patch processing. GitHub says it has deployed fixes across its cloud services. GitHub Enterprise Server updates are available in versions 3.19.15, 3.20.11, 3.21.9 and 3.22.4; patched Git releases for some bundled applications are still being coordinated.

Sources

The GitHub Blog

In this story

Microsoft

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The GitHub Blog and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Robotics Capital

Path Robotics raises $300 million at $2.45 billion valuation

Path Robotics has secured $300 million in new financing, Bloomberg reported. The funding nearly quadruples the startup's valuation to $2.45 billion.

Capital

Clara raises $105 million for hiring and market expansion

Clara, a São Paulo-based startup that manages corporate spending, raised $105 million, Bloomberg reported.

AI Capital

Sparxity closes Series A, bringing total funding to $90M

Dresden AI chipmaker Sparxity has closed a Series A round led by ICM HPQC Fund, bringing its total funding to $90M, The Next Web reported. The company did not disclose the size of the round. Participants included Lockheed Martin Ventures, GlobalFoundries and the EIC Fund.

AI Capital

Ancep raises $8.5M to automate insurance brokers' administrative work

London-based Ancep has raised $8.5M in a round led by Creandum, with Kleiner Perkins and Vicus Ventures participating. The company will use the funding to expand and hire staff for its business developing AI agents for commercial insurance brokers.

Capital Security

Dreeze emerges from stealth with $33M seed funding

Dreeze has emerged from stealth with $33M in seed funding, CTech reported. Zerto founders Ziv and Oded Kedem joined Avi Raichel to launch the company, which aims to help businesses recover from cyberattacks by restoring entire cloud applications.

Google opens Gemini 4 Carbon to paying API users and Ultra subscribers

Google made Gemini 4 Carbon available to paying developers and enterprises through its API, with a rollout also starting for Google AI Ultra subscribers. Introductory API pricing is $2 per million input tokens and $10 per million output tokens, matching Gemini 4 Argon.