Git: Heap-based buffer overflow in three-way merge via conflict-marker-size
Summary
Git versions with a flawed three-way merge routine (xdiff) contain a heap buffer overflow caused by a 32-bit integer overflow when the output size is calculated. A repository can set a very large conflict-marker-size in a committed .gitattributes file, so a small file with many conflicts makes the size wrap and writes attacker-controlled data past the end of a buffer. An attacker can crash Git and possibly corrupt heap memory, for example through git merge, git rebase or git merge-tree on an untrusted repository. On self-hosted Git servers that read attributes from repository trees, any user with push rights who can request a merge can trigger it.
Affected
- Git before 2.49.1
- Git 2.50.0-rc0 to before 2.50.2
- Git 2.51.0-rc0 to before 2.51.3
- Git 2.52.0-rc0 to before 2.52.1
- Git 2.53.0-rc0 to before 2.53.1
- Git 2.54.0-rc0 to before 2.54.1
- Git 2.55.0-rc0 to before 2.55.1
- Git 2.56.0-rc0 to before 2.56.1
- GitLab 16.2 to before 19.3.8, 19.4 before 19.4.6, 19.5 before 19.5.4
Fixed in
- Git 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or later
- GitLab 19.3.8, 19.4.6, 19.5.4 or later
- Distribution packages: Unknown; check the security tracker of your distribution
Workaround
- Self-hosted servers: add 'conflict-marker-size=7' to info/attributes in each repository, which overrides in-tree .gitattributes
- Alternatively, disable server-side mergeability checks for untrusted repositories
- Clients: do not merge untrusted repositories or branches; check .gitattributes for large conflict-marker-size values
Exploitation
- Not known to be exploited in the wild.
- No public exploit code found at time of writing.
Our recommendation
- Identify all Git installations, including bundled Git in self-hosted forges, CI images and workstations.
- Update Git to a fixed version; hosted services such as GitHub and GitLab.com are already patched by the provider.
- On self-hosted servers that cannot be patched immediately, apply the info/attributes workaround.
- Verify version numbers against the upstream advisory GHSA-vp2w-7xxj-jvxr and your distribution tracker.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
googlesky/CVE-2026-105437
Research sources
- CVE Record CVE-2026-105437 www.cve.org
- GitLab issue 814: Heap buffer overflow in xdiff three-way merge gitlab.com
- GitLab issue 632121 gitlab.com
- HackerOne report 4044249 hackerone.com
- GitLab patch release 19.5.4 docs.gitlab.com
- The Hacker News: Git patches flaw thehackernews.com
- Git for Windows releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:14.
Original description (NVD)
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written several times for every conflict. A small file with a huge marker size and many separate conflicts can therefore push the total past 4 GiB, so the integer wraps to a small value and Git writes attacker-controlled merge output past the end of a buffer that is too small. At minimum this crashes Git, and because the overflow is large and its contents are largely attacker-controlled, worse heap corruption is possible. Any command that does a textual three-way merge can trigger it, such as git-merge(1), git-rebase(1), git-cherry-pick(1), and git-merge-tree(1). The latter is most likely a target for Git forges, which might use git-merge-tree(1) on the server-side to check mergeability. When the server reads attributes from trees in the repository (for example through attr.tree or --attr-source), any user who can push branches and request that they be merged (for example by opening a pull or merge request) can trigger the overflow without anyone else doing anything, and the data they push is small because the oversized output only appears during the merge. The problem has been patched by computing the size as size_t and checking every addition for overflow, so Git stops with an error instead of overflowing. Servers that cannot upgrade right away can add * conflict-marker-size=7 to each repository's info/attributes as a workaround, which overrides any in-tree .gitattributes, or turn off server-side mergeability checks for untrusted repositories.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.