The brief
The Git project has shipped fixes for six vulnerabilities that touch several everyday operations: cloning repositories with submodules, accepting reference names from a server, merging content, applying binary patches, and importing data. Git 2.56.1 contains the fixes, with patched releases available for several older maintenance lines. The most severe recursive-clone issue can let a malicious repository replace a submodule metadata file with a link to attacker-controlled configuration or hooks, which may lead to code execution.
Other issues allow a malicious server to supply a path-traversing HEAD target, or crafted input to trigger memory corruption and out-of-bounds reads during signature removal, large merges, and binary-patch processing. The release tightens validation of paths, reference names, buffer sizes, and untrusted fast-import features. These are distinct bugs with different attack paths; the original advisory links from GitHub provide the details for each one.
GitHub recommends updating to Git 2.56.1 or the patched version for the maintenance series in use, including applications that bundle Git. Server administrators should also update installations used by automation and repository-processing services. Until an update is possible, avoid recursive clones from untrusted repositories and processing untrusted merges, patches, or import streams. Those precautions reduce exposure but do not replace installing a fixed release.
