15 matches found
CVE-2026-114467
Out-of-bounds write possible in Git when git-merge1 used on tag with more than two GPG signatures...
EUVD-2026-124400
Out-of-bounds write possible in Git when git-merge1 used on tag with more than two GPG signatures...
CVE-2026-114467
Out-of-bounds write possible in Git when git-merge1 used on tag with more than two GPG signatures...
CVE-2026-114467
A flaw in Git allows an authenticated remote attacker to cause a Denial of Service (DoS) by corrupting stack memory. The vulnerability occurs during merge operations when git-merge(1) attempts to remove more than two GPG (GNU Privacy Guard) signatures from commit messages. An attacker can trigger...
CVE-2026-114467 Out-of-bounds Write in Git
Out-of-bounds write possible in Git when git-merge1 used on tag with more than two GPG signatures...
Exploit for CVE-2026-105437
CVE-2026-105437 — Git three-way merge heap buffer overflow |...
AZL-113311 CVE-2026-105437 affecting package git 2.45.4-3
Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...
CVE-2026-105437 Heap-based Buffer Overflow in Git
Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...
CVE-2026-105437
Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...
CVE-2026-114467
When Git strips GPG signatures from a commit message, removesignature stores the start and end positions of signatures in a fixed-size stack array of two entries. A message carrying more than two signatures makes it write past the end of that array and corrupt stack memory, a denial of service th...
GHSA-W2VW-W76X-QR89 Nx: OS command injection via git revisions and remote refs
Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...
PT-2026-115376
Summary Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase /...
CVE-2026-42563
A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. An attacker can exploit this vulnerability by crafting malicious file paths within an untrusted Git branch. When a victim merges this branch, the ProcessMergeDriver component incorrectly substitutes the...
Gitea 1.27.0 diffpatch Remote Code Execution
Gitea version 1.27.0 and below contains a remote code execution vulnerability in the diffpatch API. An authenticated attacker with repository write access can submit the same specially crafted patch multiple times to trigger Git's three-way merge fallback and cause an executable post-index-change...
CVE-2021-47126
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6nhflushexceptions Reported by syzbot: HEAD commit: 90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm.. git tree:...