CVE-2026-105437

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105437", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-05T13:05:02.346Z", "datePublished": "2026-11-10T18:34:09.369Z", "dateUpdated": "2026-11-10T18:34:09.369Z"}, "containers": {"cna": {"title": "Heap-based Buffer Overflow in Git", "descriptions": [{"lang": "en", "value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}], "affected": [{"vendor": "Git", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "cpes": ["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"], "versions": [{"version": "0", "status": "affected", "lessThan": "2.49.1", "versionType": "semver"}, {"version": "2.50.0-rc0", "status": "affected", "lessThan": "2.50.2", "versionType": "semver"}, {"version": "2.51.0-rc0", "status": "affected", "lessThan": "2.51.3", "versionType": "semver"}, {"version": "2.52.0-rc0", "status": "affected", "lessThan": "2.52.1", "versionType": "semver"}, {"version": "2.53.0-rc0", "status": "affected", "lessThan": "2.53.1", "versionType": "semver"}, {"version": "2.54.0-rc0", "status": "affected", "lessThan": "2.54.1", "versionType": "semver"}, {"version": "2.55.0-rc0", "status": "affected", "lessThan": "2.55.1", "versionType": "semver"}, {"version": "2.56.0-rc0", "status": "affected", "lessThan": "2.56.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "cweId": "CWE-122", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/git/-/work_items/814"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"}, {"url": "https://hackerone.com/reports/4044249", "name": "HackerOne Bug Bounty Report #4044249", "tags": ["technical-description", "exploit", "permissions-required"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."}], "credits": [{"lang": "en", "value": "Thanks [taise](https://hackerone.com/taise) for reporting this vulnerability through HackerOne", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-11-10T18:34:09.369Z"}}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "vendor": "Git", "versions": [{"lessThan": "2.49.1", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.50.2", "status": "affected", "version": "2.50.0-rc0", "versionType": "semver"}, {"lessThan": "2.51.3", "status": "affected", "version": "2.51.0-rc0", "versionType": "semver"}, {"lessThan": "2.52.1", "status": "affected", "version": "2.52.0-rc0", "versionType": "semver"}, {"lessThan": "2.53.1", "status": "affected", "version": "2.53.0-rc0", "versionType": "semver"}, {"lessThan": "2.54.1", "status": "affected", "version": "2.54.0-rc0", "versionType": "semver"}, {"lessThan": "2.55.1", "status": "affected", "version": "2.55.0-rc0", "versionType": "semver"}, {"lessThan": "2.56.1", "status": "affected", "version": "2.56.0-rc0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}], "id": "CVE-2026-105437", "lastModified": "2026-11-12T19:05:35.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-11-10T19:17:46.200", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/git/-/work_items/814"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/632121"}, {"source": "cve@gitlab.com", "url": "https://hackerone.com/reports/4044249"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "git: git: Heap corruption via integer overflow in merge size calculations", "id": "2567428", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567428"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in Git. When calculating sizes for very large merge results, an integer overflow can occur, leading to the allocation of an undersized buffer. An attacker could exploit this vulnerability by supplying crafted repository data during merge operations to cause heap memory corruption. This issue primarily impacts system stability and can result in an application crash, causing a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-105437", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T18:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105437\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105437"], "statement": "Red Hat rates this flaw as Important because heap memory corruption caused by an integer overflow can lead to arbitrary code execution within the context of the user executing Git. While exploitation can yield severe impacts on confidentiality, integrity, and availability, successful exploitation requires user interaction to initiate merge actions on crafted repository content. In typical Red Hat deployments, risk is primarily concentrated in developer environments and automated CI/CD systems processing untrusted pull requests or branches.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.49.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.50.0-rc0,2.50.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.51.0-rc0,2.51.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.52.0-rc0,2.52.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.53.0-rc0,2.53.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.54.0-rc0,2.54.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.55.0-rc0,2.55.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.56.0-rc0,2.56.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Git", "source": "cna", "vendor": "Git"}, "product": "git", "vendor": "git"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "git", "vendor": "git-scm"}], "created": "2026-11-11T15:30:09.361703+00:00", "updated": "2026-11-13T01:30:09.451381+00:00", "vendors": ["git", "git$PRODUCT$git", "git-scm", "git-scm$PRODUCT$git"]}