CVE-2026-62960

Git for Windows prior to 2.55.0.windows.4 is vulnerable to a security bypass in bundle-uri.c . When transfer.bundleuri=true, a malicious remote Git server can advertise a bundle URI processed by transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). Non-HTTP(S) va...