CVE-2026-114467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114467", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-21T15:02:50.482Z", "datePublished": "2026-11-12T13:13:05.067Z", "dateUpdated": "2026-11-12T13:13:05.067Z"}, "containers": {"cna": {"title": "Out-of-bounds Write in Git", "descriptions": [{"lang": "en", "value": "Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}], "affected": [{"vendor": "Git", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "cpes": ["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"], "versions": [{"version": "2.50.1", "status": "affected"}, {"version": "2.51.2", "status": "affected"}, {"version": "2.52.0", "status": "affected"}, {"version": "2.53.0", "status": "affected"}, {"version": "2.54.0", "status": "affected"}, {"version": "2.55.0", "status": "affected"}, {"version": "2.56.0", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-787: Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/git/-/work_items/810"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."}], "credits": [{"lang": "en", "value": "ehdgks0627, un3xploitable", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-11-12T13:13:05.067Z"}}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "vendor": "Git", "versions": [{"status": "affected", "version": "2.50.1"}, {"status": "affected", "version": "2.51.2"}, {"status": "affected", "version": "2.52.0"}, {"status": "affected", "version": "2.53.0"}, {"status": "affected", "version": "2.54.0"}, {"status": "affected", "version": "2.55.0"}, {"status": "affected", "version": "2.56.0"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}], "id": "CVE-2026-114467", "lastModified": "2026-11-12T19:05:35.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-11-12T14:17:23.360", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/git/-/work_items/810"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "git: git: Denial of service via commit messages with multiple GPG signatures", "id": "2567370", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567370"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in git. An authenticated remote attacker can cause a Denial of Service (DoS) by corrupting stack memory during merge operations. This issue occurs when git attempts to remove more than two GPG (GNU Privacy Guard) signatures from commit messages. By submitting a specially crafted commit containing multiple signatures, an attacker can crash the git process."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-114467", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T18:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114467\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114467"], "statement": "Red Hat has evaluated this vulnerability as having a Moderate impact because exploitation is limited to causing a denial of service during merge actions, without compromising system integrity or confidentiality. The risk is constrained to git client operations or server-side automated merge workflows processing maliciously formatted commit logs with multiple signature headers. Because standard git execution fails safely via a process crash without granting elevated privileges or persistent service disruption, the overall severity is kept within the Moderate rating.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "git", "vendor": "git"}], "created": "2026-11-12T09:45:22.063127+00:00", "updated": "2026-11-13T06:00:08.958732+00:00", "vendors": ["git", "git$PRODUCT$git"]}