CVE-2026-114469

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114469", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-21T15:02:55.490Z", "datePublished": "2026-11-12T13:12:55.269Z", "dateUpdated": "2026-11-12T13:12:55.269Z"}, "containers": {"cna": {"title": "Out-of-bounds Read in Git", "descriptions": [{"lang": "en", "value": "Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}], "affected": [{"vendor": "Git", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "versions": [{"version": "2.50.1", "status": "affected"}, {"version": "2.51.2", "status": "affected"}, {"version": "2.52.0", "status": "affected"}, {"version": "2.53.0", "status": "affected"}, {"version": "2.54.0", "status": "affected"}, {"version": "2.55.0", "status": "affected"}, {"version": "2.56.0", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/git/-/work_items/811"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."}], "credits": [{"lang": "en", "value": "ehdgks0627, un3xploitable", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-11-12T13:12:55.269Z"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "vendor": "Git", "versions": [{"status": "affected", "version": "2.50.1"}, {"status": "affected", "version": "2.51.2"}, {"status": "affected", "version": "2.52.0"}, {"status": "affected", "version": "2.53.0"}, {"status": "affected", "version": "2.54.0"}, {"status": "affected", "version": "2.55.0"}, {"status": "affected", "version": "2.56.0"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}], "id": "CVE-2026-114469", "lastModified": "2026-11-12T19:05:35.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-11-12T14:17:23.500", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/git/-/work_items/811"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "git: git: Denial of Service via binary patch size validation bypass", "id": "2567427", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567427"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in Git. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the application. During the processing of binary patches, size validation incorrectly inspects the compressed input rather than the expanded data. By submitting a specially crafted binary patch, an attacker can bypass this check and trigger an out-of-bounds memory read."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-114469", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T18:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114469\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114469"], "statement": "Red Hat rates this vulnerability as Moderate because exploitation is restricted to an out-of-bounds read causing a process crash, without enabling arbitrary code execution or unauthorized data exposure. In typical Red Hat deployments, Git operates as an ephemeral, unprivileged client utility within CI/CD pipelines or interactive developer sessions. Consequently, an attack using a malformed binary patch disrupts the immediate Git command execution while leaving the host environment intact.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "git", "vendor": "git"}], "created": "2026-11-11T19:30:09.411459+00:00", "updated": "2026-11-13T05:15:09.424328+00:00", "vendors": ["git", "git$PRODUCT$git"]}