Git Fixes Recursive Clone Code Execution Flaw

A critical integer truncation bug was disclosed today that allows a malicious repository to execute arbitrary code when cloned recursively along with its submodules. The flaw, tracked as CVE‑2026‑111760, arises because the `git clone --recursive` command calculates a submodule count based on an index value that can be manipulated by attacker-controlled input, leading to memory corruption.¹

This issue mirrors the principle behind Git's earlier vulnerability CVE‑2017‑5643, which involved overflowing buffers during symbolic ref handling; however, the current flaw specifically targets submodule processing and thus represents a distinct attack vector within Git’s architecture for recursive cloning—a common operation among developers using monorepos or complex dependency trees hosted on services such as GitHub or GitLab.

The Git project fixed the problem this week in version 2.56.1, and applied matching fixes to releases 2.50 through 2.55 (2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1).¹

Many CI/CD pipelines rely heavily on automated `git clone` operations; failing to apply this patch exposes infrastructure and data to compromise.

Developers are urged to upgrade immediately to any 2.50+ release or later, and to audit repositories for malicious submodule references until all systems are patched. The CVE identifier indicates the issue was first reported internally at GitLab prior to public disclosure.