{"id":"CVE-2025-48385","aliases":["ALPINE-CVE-2025-48385","ALSA-2025:11462","ALSA-2025:11533","ALSA-2025:11534","AZL-65040","AZL-65051","BELL-CVE-2025-48385","BIT-git-2025-48385","CLSA-2025-1752576917","CLSA-2025-1753729385","DEBIAN-CVE-2025-48385","EUVD-2025-20678","GHSA-m98c-vgpc-9655","OESA-2025-1845","OESA-2025-1846","OESA-2025-1847","OESA-2026-3879","OESA-2026-3880","OESA-2026-4068","RHSA-2025:11462","RHSA-2025:11533","RHSA-2025:11534","RHSA-2025:11686","RHSA-2025:11794","RHSA-2025:11795","RLSA-2025:11462","RLSA-2025:11534","ROOT-OS-DEBIAN-12-CVE-2025-48385","SUSE-SU-2025:03012-1","SUSE-SU-2025:03037-1","SUSE-SU-2025:20721-1","SUSE-SU-2025:20855-1","UBUNTU-CVE-2025-48385","USN-7626-1","openSUSE-SU-2025:15337-1"],"status":"published","title":"Git alllows arbitrary file writes via bundle-uri parameter injection","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0106,"percentile":0.64793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-73","CWE-88"],"published":"2025-07-08T17:00:00Z","modified":"2026-10-29T11:32:26Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"git","fixed_in":["2.43.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"git","fixed_in":["2.45.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"git","fixed_in":["2.47.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"git","fixed_in":["2.49.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"git","fixed_in":["2.50.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"git","fixed_in":["2.50.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"git","fixed_in":["2.45.4-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"git","fixed_in":["2.40.4-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"git","fixed_in":["2.43.7-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"git","fixed_in":["2.49.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"git","fixed_in":["2.50.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"git","fixed_in":["2.50.1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-all","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-core","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-core-doc","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-credential-libsecret","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-daemon","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-email","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-gui","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-instaweb","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-subtree","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"git-svn","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"gitk","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"gitweb","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"perl-Git","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"perl-Git-SVN","fixed_in":["2.43.0-1.el8.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-all","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-core","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-core-doc","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-credential-libsecret","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-daemon","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-email","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-gui","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-instaweb","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-subtree","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-svn","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gitk","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"gitweb","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Git","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Git-SVN","fixed_in":["2.39.3-1.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"git","fixed_in":["1:2.39.5-0+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"git","fixed_in":["1:2.47.3-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"git","fixed_in":["1:2.50.1-0.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-git","fixed_in":["1:2.39.5-0+deb12u2.root.io.6","1:2.39.5-0+deb12u2.root.io.4","1:2.39.5-0+deb12u2.root.io.5","1:2.39.5-0+deb12u2.root.io.7","1:2.39.5-0+deb12u2.root.io.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"git","fixed_in":["1:2.43.0-1ubuntu7.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.49.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Azure Linux:3","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.4-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.38.1-r0"},{"fixed":"2.43.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.49.0-r0"},{"fixed":"2.49.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.41.0-r0"},{"fixed":"2.50.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"git","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.50.1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-1.el8.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.39.3-1.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.39.5-0+deb12u3"}]}],"versions":["1:2.39.2+next.20230215-1","1:2.39.2-1.1","1:2.39.5-0+deb12u1","1:2.39.5-0+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.47.3-0+deb13u1"}]}],"versions":["1:2.47.2-0.2"]},{"source":"osv","ecosystem":"Debian:14","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.50.1-0.1"}]}],"versions":["1:2.47.2-0.2","1:2.48.0~rc1+next.20250101-1","1:2.49.0+next.20250314-1","1:2.49.0-1","1:2.49.0-2","1:2.49.0-3","1:2.50.0+next.20250615-1","1:2.50.0-1","1:2.50.0~rc0+next.20250528-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-9.oe2403"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-9.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.0-9.oe2403sp2"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-2.oe2403sp1"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-3.oe2403sp3"}]}],"bundled":34},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-2.oe2403sp4"}]}],"bundled":45},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.5-1.el9_4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el8_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-core-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-credential-libsecret","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-credential-libsecret-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-daemon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-email","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-gui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-instaweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-subtree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"git-svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gitk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"gitweb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-Git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-Git-SVN","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.39.5-1.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47.3-1.el9_6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.43.7-1.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.39.5-0+deb12u2.root.io.6"},{"fixed":"1:2.39.5-0+deb12u2.root.io.4"},{"fixed":"1:2.39.5-0+deb12u2.root.io.5"},{"fixed":"1:2.39.5-0+deb12u2.root.io.7"},{"fixed":"1:2.39.5-0+deb12u2.root.io.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-150600.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-150600.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-150600.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-150600.13.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"obs-scm-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.4-150600.14.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-150600.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-150600.13.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"obs-scm-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.4-150600.14.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-PyYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-150600.10.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-PyYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-150600.10.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-150600.3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-150600.13.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"obs-scm-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.4-150600.14.4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-PyYAML","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-150600.10.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.43.7-150300.10.51.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.51.0-slfo.1.1_1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.43.0-1ubuntu7.3"}]}],"versions":["1:2.40.1-1ubuntu1","1:2.43.0-1ubuntu1","1:2.43.0-1ubuntu5","1:2.43.0-1ubuntu6","1:2.43.0-1ubuntu7","1:2.43.0-1ubuntu7.1","1:2.43.0-1ubuntu7.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.4-0ubuntu1.10+esm9"}]}],"versions":["1:2.5.0-1","1:2.6.2-1","1:2.6.3-1","1:2.6.4-1","1:2.7.0~rc3-1","1:2.7.0-1","1:2.7.3-0ubuntu1","1:2.7.4-0ubuntu1","1:2.7.4-0ubuntu1.1","1:2.7.4-0ubuntu1.2","1:2.7.4-0ubuntu1.3","1:2.7.4-0ubuntu1.4","1:2.7.4-0ubuntu1.5","1:2.7.4-0ubuntu1.6","1:2.7.4-0ubuntu1.7","1:2.7.4-0ubuntu1.8","1:2.7.4-0ubuntu1.9","1:2.7.4-0ubuntu1.10","1:2.7.4-0ubuntu1.10+esm1","1:2.7.4-0ubuntu1.10+esm3","1:2.7.4-0ubuntu1.10+esm4","1:2.7.4-0ubuntu1.10+esm5","1:2.7.4-0ubuntu1.10+esm6","1:2.7.4-0ubuntu1.10+esm7","1:2.7.4-0ubuntu1.10+esm8"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.17.1-1ubuntu0.18+esm2"}]}],"versions":["1:2.14.1-1ubuntu4","1:2.15.1-1ubuntu2","1:2.17.0-1ubuntu1","1:2.17.1-1ubuntu0.1","1:2.17.1-1ubuntu0.3","1:2.17.1-1ubuntu0.4","1:2.17.1-1ubuntu0.5","1:2.17.1-1ubuntu0.6","1:2.17.1-1ubuntu0.7","1:2.17.1-1ubuntu0.8","1:2.17.1-1ubuntu0.9","1:2.17.1-1ubuntu0.10","1:2.17.1-1ubuntu0.11","1:2.17.1-1ubuntu0.12","1:2.17.1-1ubuntu0.13","1:2.17.1-1ubuntu0.14","1:2.17.1-1ubuntu0.15","1:2.17.1-1ubuntu0.16","1:2.17.1-1ubuntu0.17","1:2.17.1-1ubuntu0.18","1:2.17.1-1ubuntu0.18+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.25.1-1ubuntu3.14+esm1"}]}],"versions":["1:2.20.1-2ubuntu1","1:2.24.0-1ubuntu1","1:2.24.0-1ubuntu2","1:2.25.0-1ubuntu1","1:2.25.1-1ubuntu1","1:2.25.1-1ubuntu2","1:2.25.1-1ubuntu3","1:2.25.1-1ubuntu3.1","1:2.25.1-1ubuntu3.2","1:2.25.1-1ubuntu3.3","1:2.25.1-1ubuntu3.4","1:2.25.1-1ubuntu3.5","1:2.25.1-1ubuntu3.6","1:2.25.1-1ubuntu3.7","1:2.25.1-1ubuntu3.8","1:2.25.1-1ubuntu3.10","1:2.25.1-1ubuntu3.11","1:2.25.1-1ubuntu3.12","1:2.25.1-1ubuntu3.13","1:2.25.1-1ubuntu3.14"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.34.1-1ubuntu1.13"}]}],"versions":["1:2.32.0-1ubuntu1","1:2.33.1-1ubuntu1","1:2.34.1-1ubuntu1","1:2.34.1-1ubuntu1.1","1:2.34.1-1ubuntu1.2","1:2.34.1-1ubuntu1.4","1:2.34.1-1ubuntu1.5","1:2.34.1-1ubuntu1.6","1:2.34.1-1ubuntu1.8","1:2.34.1-1ubuntu1.9","1:2.34.1-1ubuntu1.10","1:2.34.1-1ubuntu1.11","1:2.34.1-1ubuntu1.12"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.43.0-1ubuntu7.3"}]}],"versions":["1:2.40.1-1ubuntu1","1:2.43.0-1ubuntu1","1:2.43.0-1ubuntu5","1:2.43.0-1ubuntu6","1:2.43.0-1ubuntu7","1:2.43.0-1ubuntu7.1","1:2.43.0-1ubuntu7.2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.50.1-1.1"}]}],"bundled":7}],"products":[{"vendor":"git","product":"git"},{"vendor":"git-for-windows","product":"git"}],"references":[{"url":"https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655","tags":["x_refsource_CONFIRM","web","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/08/4","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-48385","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11462","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-50349","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52006","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27613","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-27614","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46835","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48384","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48385","tags":["report"]},{"url":"https://bugzilla.redhat.com/2337824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2337956","tags":["report"]},{"url":"https://bugzilla.redhat.com/2378806","tags":["report"]},{"url":"https://bugzilla.redhat.com/2378808","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379124","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379125","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379326","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-11462.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11533","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-11533.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11534","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-11534.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48385","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-48385","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2025-1752576917.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1753729385.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48385.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48385","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48386","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1846","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1847","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47910","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42507","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3880","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2337824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2337956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2378806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2378808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379326","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11462.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50349","tags":["advisory"]},{"url":"https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8","tags":["article"]},{"url":"https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577","tags":["article"]},{"url":"https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52006","tags":["advisory"]},{"url":"https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g","tags":["article"]},{"url":"https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060","tags":["article"]},{"url":"https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","tags":["article"]},{"url":"https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27613","tags":["advisory"]},{"url":"https://github.com/j6t/gitk/security/advisories/GHSA-f3cw-xrj3-wr2v","tags":["article"]},{"url":"https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2025/07/08/4","tags":["article","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27614","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46835","tags":["advisory"]},{"url":"https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a437f5bc93330a70b42a230e52f3bd036ca1b1da","tags":["article"]},{"url":"https://github.com/j6t/git-gui/security/advisories/GHSA-xfx7-68v4-v8fg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48384","tags":["advisory"]},{"url":"https://dgl.cx/2025/07/git-clone-submodule-cve-2025-48384","tags":["article"]},{"url":"https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89","tags":["article"]},{"url":"https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48385","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11533.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11534.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11686","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11686.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11794","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11794.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11795","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11795.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:11462","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:11534","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503012-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212476","tags":["report"]},{"url":"https://bugzilla.suse.com/1216545","tags":["report"]},{"url":"https://bugzilla.suse.com/1218588","tags":["report"]},{"url":"https://bugzilla.suse.com/1218664","tags":["report"]},{"url":"https://bugzilla.suse.com/1243197","tags":["report"]},{"url":"https://bugzilla.suse.com/1245938","tags":["report"]},{"url":"https://bugzilla.suse.com/1245939","tags":["report"]},{"url":"https://bugzilla.suse.com/1245942","tags":["report"]},{"url":"https://bugzilla.suse.com/1245943","tags":["report"]},{"url":"https://bugzilla.suse.com/1245946","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48385","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503037-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520721-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219660","tags":["report"]},{"url":"https://bugzilla.suse.com/1235600","tags":["report"]},{"url":"https://bugzilla.suse.com/1235601","tags":["report"]},{"url":"https://bugzilla.suse.com/1239989","tags":["report"]},{"url":"https://bugzilla.suse.com/1245947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48386","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520855-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-48385","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7626-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-27613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-27614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-46835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48384","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-48386","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48385","title":"Git alllows arbitrary file writes via bundle-uri parameter injection","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T18:23:44.405Z","modified":"2025-11-04T21:11:01.641Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-88","CWE-73"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-20678","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T18:23:44Z","modified":"2025-11-04T21:11:01Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"nvd":[{"id":"CVE-2025-48385","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T19:15:43.097Z","modified":"2026-06-17T09:29:35.257Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-73","CWE-88"],"updated_at":"2026-11-02T14:11:17.727956Z"}],"osv":[{"id":"ALPINE-CVE-2025-48385","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T19:15:43.097Z","modified":"2026-08-27T22:18:02.916998221Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2025-48385","title":"Git alllows arbitrary file writes via bundle-uri parameter injection","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T18:23:44.405Z","modified":"2026-10-28T02:31:11.413944935Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-73","CWE-88"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48385","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T19:15:43.097Z","modified":"2026-09-01T20:05:53.08122319Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-1845","title":"git security update","description":"Security Fix(es):\n\nA vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (affected version not known). It has been classified as problematic.This is going to have an impact on confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27613)\n\nA vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (the affected version unknown). It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27614)\n\nA vulnerability, which was classified as problematic, has been found in Microsoft Visual Studio (Programming Tool Software) (version unknown).Impacted is confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-46334)\n\nA vulnerability was found in j6t git-gui up to 2.50.0 (Versioning Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component\nin another control sphere, but it does not properly delimit the\nintended arguments, options, or switches within that command string.Impacted is confidentiality, integrity, and availability.The vulnerability scanner Nessus provides a plugin with the ID 241644 (FreeBSD : git -- multiple vulnerabilities (2a4472ed-5c0d-11f0-b991-291fce777db8)), which helps to determine the existence of the flaw in a target environment.Upgrading to version 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 or 2.50.1 eliminates this vulnerability.The vulnerability is also documented in the vulnerability database at Tenable (241644).(CVE-2025-46835)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48384)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48386)","status":"published","published":"2025-07-18T11:08:55Z","modified":"2026-08-18T01:18:54.006607756Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1846","title":"git security update","description":"Security Fix(es):\n\nA vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (affected version not known). It has been classified as problematic.This is going to have an impact on confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27613)\n\nA vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (the affected version unknown). It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27614)\n\nA vulnerability, which was classified as problematic, has been found in Microsoft Visual Studio (Programming Tool Software) (version unknown).Impacted is confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-46334)\n\nA vulnerability was found in j6t git-gui up to 2.50.0 (Versioning Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component\nin another control sphere, but it does not properly delimit the\nintended arguments, options, or switches within that command string.Impacted is confidentiality, integrity, and availability.The vulnerability scanner Nessus provides a plugin with the ID 241644 (FreeBSD : git -- multiple vulnerabilities (2a4472ed-5c0d-11f0-b991-291fce777db8)), which helps to determine the existence of the flaw in a target environment.Upgrading to version 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 or 2.50.1 eliminates this vulnerability.The vulnerability is also documented in the vulnerability database at Tenable (241644).(CVE-2025-46835)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48384)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48386)","status":"published","published":"2025-07-18T11:08:56Z","modified":"2026-08-18T01:18:54.124055053Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1847","title":"git security update","description":"Security Fix(es):\n\nA vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (affected version not known). It has been classified as problematic.This is going to have an impact on confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27613)\n\nA vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (the affected version unknown). It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27614)\n\nA vulnerability, which was classified as problematic, has been found in Microsoft Visual Studio (Programming Tool Software) (version unknown).Impacted is confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-46334)\n\nA vulnerability was found in j6t git-gui up to 2.50.0 (Versioning Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component\nin another control sphere, but it does not properly delimit the\nintended arguments, options, or switches within that command string.Impacted is confidentiality, integrity, and availability.The vulnerability scanner Nessus provides a plugin with the ID 241644 (FreeBSD : git -- multiple vulnerabilities (2a4472ed-5c0d-11f0-b991-291fce777db8)), which helps to determine the existence of the flaw in a target environment.Upgrading to version 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1 or 2.50.1 eliminates this vulnerability.The vulnerability is also documented in the vulnerability database at Tenable (241644).(CVE-2025-46835)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48384)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48386)","status":"published","published":"2025-07-18T11:08:56Z","modified":"2026-08-18T01:18:54.204687131Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2026-3879","title":"git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\r\n\r\nSecurity Fix(es):\n\nThe filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk\u0026apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)\n\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)\n\nIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\u0026quot;\u0026quot;, \u0026quot;.\u0026quot;, and \u0026quot;..\u0026quot;), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)\n\nWhen using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)\n\nThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \u0026quot;http://[::1]/\u0026quot;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)\n\nA vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as problematic.Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 1.25.2 eliminates this vulnerability.(CVE-2025-58183)\n\nParsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)\n\nDespite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \u0026quot;a=;\u0026quot;, an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)\n\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)\n\nWhen Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)\n\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)\n\nThe Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)\n\nThe net/url package in the Go standard library does not impose a limit on the number of query parameters in a query string. While the overall size of query parameters in URLs is generally constrained by the maximum request header size, the net/http.Request.ParseForm method is capable of parsing large URL-encoded forms. An attacker can exploit this by submitting a form containing an excessive number of unique query parameters, leading to disproportionate memory consumption and potentially causing a Denial of Service (DoS) condition in the affected application.(CVE-2025-61726)\n\nAn excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)\n\nWithin HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)\n\nDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.(CVE-2025-68121)\n\n[\u0026apos;announces:\u0026apos;, \u0026quot;We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n  * crypto/x509: incorrect enforcement of email constraints\\n\\n    When verifying a certificate chain which contains a certificate containing\\n    multiple email address constraints (composed of the full email address)\\n    which share common local portions (the portion of the address before the \u0026apos;@\u0026apos;\\n    character) but different domain portions (the portion of the address after\\n    the \u0026apos;@\u0026apos; character), these constraints will not be properly applied, and only\\n    the last constraint will be considered.\\n\\n    This can allow certificates in the chain containing email addresses which\\n    are either not permitted or excluded by the relevant constraints to be\\n    returned by calls to Certificate.Verify. Since the name constraint checks\\n    happen after chain building is complete, this only applies to certificate\\n    chains which chain to trusted roots (root certificates either in\\n    VerifyOptions.Roots or in the system root certificate pool), requiring a\\n    trusted CA to issue certificates containing either not permitted or\\n    excluded email addresses.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27137 and Go issue\u0026quot;, \u0026apos;.\\n\\n  * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n    Certificate verification can panic when a certificate in the chain has an\\n    empty DNS name and another certificate in the chain has excluded name\\n    constraints. This can crash programs that are either directly verifying\\n    X.509 certificate chains, or those that use TLS.\\n\\n    Since the name constraint checks happen after chain building is complete,\\n    this only applies to certificate chains which chain to trusted roots (root\\n    certificates either in VerifyOptions.Roots or in the system root certificate\\n    pool), requiring a trusted CA to issue certificates containing malformed DNS\\n    names.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27138 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * html/template: URLs in meta content attribute actions are not escaped\\n\\n    Actions which insert URLs into the content attribute of HTML meta tags are\\n    not escaped. This can allow XSS if the meta tag also has an http-equiv\\n    attribute with the value \u0026quot;refresh\u0026quot;.\\n\\n    A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n    used to disable escaping URLs in actions in the meta content attribute which\\n    follow \u0026quot;url=\u0026quot; by setting htmlmetacontenturlescape=0.\\n\\n    This is CVE-2026-27142 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * net/url: reject IPv6 literal not at start of host\\n\\n    The Go standard library function net/url.Parse insufficiently\\n    validated the host/authority component and accepted some invalid URLs\\n    by effectively treating garbage before an IP-literal as ignorable.\\n    The function should have rejected this as invalid.\\n\\n    To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n    that do not appear at the start of the host subcomponent of a URL.\\n\\n    Thanks to Masaki Hara (\u0026apos;, \u0026apos;) of Wantedly.\\n\\n    This is CVE-2026-25679 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * os: FileInfo can escape from a Root\\n\\n    On Unix platforms, when listing the contents of a directory using\\n    File.ReadDir or File.Readdir the returned FileInfo could reference\\n    a file outside of the Root in which the File was opened.\\n\\n    The contents of the FileInfo were populated using the lstat system\\n    call, which takes the path to the file as a parameter. If a component\\n    of the full path of the file described by the FileInfo is replaced with\\n    a symbolic link, the target of the lstat can be directed to another\\n    location on the filesystem.\\n\\n    The impact of this escape is limited to reading metadata provided by\\n    lstat from arbitrary locations on the filesystem. This could be used\\n    to p(CVE-2026-25679)\n\nWhen verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.(CVE-2026-27137)\n\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic(CVE-2026-27141)\n\nDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)\n\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-32281)\n\nOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.(CVE-2026-32282)\n\nWhen verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-33810)\n\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.(CVE-2026-33811)\n\nA vulnerability was found in the encoding/asn1 package in Go. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.(CVE-2026-33818)\n\nWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.(CVE-2026-42507)\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.(CVE-2026-46600)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.(CVE-2026-56853)\n\nA flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, causing the depth counter to reset and never fire, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)","status":"published","published":"2026-09-20T13:22:51Z","modified":"2026-09-20T13:30:21.787721587Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3880","title":"git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\r\n\r\nSecurity Fix(es):\n\nThe filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk\u0026apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)\n\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)\n\nIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\u0026quot;\u0026quot;, \u0026quot;.\u0026quot;, and \u0026quot;..\u0026quot;), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)\n\nWhen using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)\n\nThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \u0026quot;http://[::1]/\u0026quot;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)\n\nA vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as problematic.Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 1.25.2 eliminates this vulnerability.(CVE-2025-58183)\n\nParsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)\n\nDespite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \u0026quot;a=;\u0026quot;, an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)\n\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)\n\nWhen Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)\n\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)\n\nThe Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)\n\nThe net/url package in the Go standard library does not impose a limit on the number of query parameters in a query string. While the overall size of query parameters in URLs is generally constrained by the maximum request header size, the net/http.Request.ParseForm method is capable of parsing large URL-encoded forms. An attacker can exploit this by submitting a form containing an excessive number of unique query parameters, leading to disproportionate memory consumption and potentially causing a Denial of Service (DoS) condition in the affected application.(CVE-2025-61726)\n\nAn excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)\n\nWithin HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)\n\nDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.(CVE-2025-68121)\n\n[\u0026apos;announces:\u0026apos;, \u0026quot;We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n  * crypto/x509: incorrect enforcement of email constraints\\n\\n    When verifying a certificate chain which contains a certificate containing\\n    multiple email address constraints (composed of the full email address)\\n    which share common local portions (the portion of the address before the \u0026apos;@\u0026apos;\\n    character) but different domain portions (the portion of the address after\\n    the \u0026apos;@\u0026apos; character), these constraints will not be properly applied, and only\\n    the last constraint will be considered.\\n\\n    This can allow certificates in the chain containing email addresses which\\n    are either not permitted or excluded by the relevant constraints to be\\n    returned by calls to Certificate.Verify. Since the name constraint checks\\n    happen after chain building is complete, this only applies to certificate\\n    chains which chain to trusted roots (root certificates either in\\n    VerifyOptions.Roots or in the system root certificate pool), requiring a\\n    trusted CA to issue certificates containing either not permitted or\\n    excluded email addresses.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27137 and Go issue\u0026quot;, \u0026apos;.\\n\\n  * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n    Certificate verification can panic when a certificate in the chain has an\\n    empty DNS name and another certificate in the chain has excluded name\\n    constraints. This can crash programs that are either directly verifying\\n    X.509 certificate chains, or those that use TLS.\\n\\n    Since the name constraint checks happen after chain building is complete,\\n    this only applies to certificate chains which chain to trusted roots (root\\n    certificates either in VerifyOptions.Roots or in the system root certificate\\n    pool), requiring a trusted CA to issue certificates containing malformed DNS\\n    names.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27138 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * html/template: URLs in meta content attribute actions are not escaped\\n\\n    Actions which insert URLs into the content attribute of HTML meta tags are\\n    not escaped. This can allow XSS if the meta tag also has an http-equiv\\n    attribute with the value \u0026quot;refresh\u0026quot;.\\n\\n    A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n    used to disable escaping URLs in actions in the meta content attribute which\\n    follow \u0026quot;url=\u0026quot; by setting htmlmetacontenturlescape=0.\\n\\n    This is CVE-2026-27142 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * net/url: reject IPv6 literal not at start of host\\n\\n    The Go standard library function net/url.Parse insufficiently\\n    validated the host/authority component and accepted some invalid URLs\\n    by effectively treating garbage before an IP-literal as ignorable.\\n    The function should have rejected this as invalid.\\n\\n    To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n    that do not appear at the start of the host subcomponent of a URL.\\n\\n    Thanks to Masaki Hara (\u0026apos;, \u0026apos;) of Wantedly.\\n\\n    This is CVE-2026-25679 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * os: FileInfo can escape from a Root\\n\\n    On Unix platforms, when listing the contents of a directory using\\n    File.ReadDir or File.Readdir the returned FileInfo could reference\\n    a file outside of the Root in which the File was opened.\\n\\n    The contents of the FileInfo were populated using the lstat system\\n    call, which takes the path to the file as a parameter. If a component\\n    of the full path of the file described by the FileInfo is replaced with\\n    a symbolic link, the target of the lstat can be directed to another\\n    location on the filesystem.\\n\\n    The impact of this escape is limited to reading metadata provided by\\n    lstat from arbitrary locations on the filesystem. This could be used\\n    to p(CVE-2026-25679)\n\nWhen verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.(CVE-2026-27137)\n\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic(CVE-2026-27141)\n\nDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)\n\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-32281)\n\nOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.(CVE-2026-32282)\n\nWhen verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-33810)\n\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.(CVE-2026-33811)\n\nA vulnerability was found in the encoding/asn1 package in Go. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.(CVE-2026-33818)\n\nWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.(CVE-2026-42507)\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.(CVE-2026-46600)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.(CVE-2026-56853)\n\nA flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, causing the depth counter to reset and never fire, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)","status":"published","published":"2026-09-20T13:22:51Z","modified":"2026-09-20T13:30:21.883092864Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4068","title":"git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\r\n\r\nSecurity Fix(es):\n\nProcessing an incomplete post-handshake message for a QUIC connection can cause a panic.(CVE-2023-39321)\n\nQUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.(CVE-2023-39322)\n\nThe filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/time of use) race condition where a portion of the path being walked is replaced with a symbolic link while the walk is in progress.(CVE-2024-8244)\n\nCalling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.(CVE-2025-22874)\n\nGit LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository\u0026apos;s working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.(CVE-2025-26625)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk\u0026apos;s Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-27613)\n\nGitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the attacker by invoking gitk filename, where filename has a particular structure. The script is run with the privileges of the user. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.(CVE-2025-27614)\n\nProxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.(CVE-2025-4673)\n\nThe go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \u0026quot;go get\u0026quot;, are not affected.(CVE-2025-4674)\n\nGit GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user has write permission. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.(CVE-2025-46835)\n\nIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\u0026quot;\u0026quot;, \u0026quot;.\u0026quot;, and \u0026quot;..\u0026quot;), can result in the binaries listed in the PATH being unexpectedly returned.(CVE-2025-47906)\n\nCancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.(CVE-2025-47907)\n\nWhen using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.(CVE-2025-47910)\n\nThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \u0026quot;http://[::1]/\u0026quot;. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)\n\nSSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.(CVE-2025-47914)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48384)\n\nGit is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.(CVE-2025-48385)\n\nSSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.(CVE-2025-58181)\n\nA vulnerability was found in Google Go up to 1.25.1 (Programming Language Software). It has been rated as problematic.Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 1.25.2 eliminates this vulnerability.(CVE-2025-58183)\n\nParsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)\n\nDespite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \u0026quot;a=;\u0026quot;, an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)\n\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)\n\nValidating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.(CVE-2025-58188)\n\nWhen Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)\n\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)\n\nThe Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)\n\nThe ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.(CVE-2025-61725)\n\nThe net/url package in the Go standard library does not impose a limit on the number of query parameters in a query string. While the overall size of query parameters in URLs is generally constrained by the maximum request header size, the net/http.Request.ParseForm method is capable of parsing large URL-encoded forms. An attacker can exploit this by submitting a form containing an excessive number of unique query parameters, leading to disproportionate memory consumption and potentially causing a Denial of Service (DoS) condition in the affected application.(CVE-2025-61726)\n\nAn excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)\n\nWithin HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)\n\nDuring session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.(CVE-2025-68121)\n\n[\u0026apos;announces:\u0026apos;, \u0026quot;We have just released Go versions 1.26.1 and 1.25.8, minor point releases.\\n\\nThese releases include 5 security fixes following the security policy:\\n\\n  * crypto/x509: incorrect enforcement of email constraints\\n\\n    When verifying a certificate chain which contains a certificate containing\\n    multiple email address constraints (composed of the full email address)\\n    which share common local portions (the portion of the address before the \u0026apos;@\u0026apos;\\n    character) but different domain portions (the portion of the address after\\n    the \u0026apos;@\u0026apos; character), these constraints will not be properly applied, and only\\n    the last constraint will be considered.\\n\\n    This can allow certificates in the chain containing email addresses which\\n    are either not permitted or excluded by the relevant constraints to be\\n    returned by calls to Certificate.Verify. Since the name constraint checks\\n    happen after chain building is complete, this only applies to certificate\\n    chains which chain to trusted roots (root certificates either in\\n    VerifyOptions.Roots or in the system root certificate pool), requiring a\\n    trusted CA to issue certificates containing either not permitted or\\n    excluded email addresses.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27137 and Go issue\u0026quot;, \u0026apos;.\\n\\n  * crypto/x509: panic in name constraint checking for malformed certificates\\n\\n    Certificate verification can panic when a certificate in the chain has an\\n    empty DNS name and another certificate in the chain has excluded name\\n    constraints. This can crash programs that are either directly verifying\\n    X.509 certificate chains, or those that use TLS.\\n\\n    Since the name constraint checks happen after chain building is complete,\\n    this only applies to certificate chains which chain to trusted roots (root\\n    certificates either in VerifyOptions.Roots or in the system root certificate\\n    pool), requiring a trusted CA to issue certificates containing malformed DNS\\n    names.\\n\\n    This issue only affects Go 1.26.\\n\\n    Thanks to Jakub Ciolek for reporting this issue.\\n\\n    This is CVE-2026-27138 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * html/template: URLs in meta content attribute actions are not escaped\\n\\n    Actions which insert URLs into the content attribute of HTML meta tags are\\n    not escaped. This can allow XSS if the meta tag also has an http-equiv\\n    attribute with the value \u0026quot;refresh\u0026quot;.\\n\\n    A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be\\n    used to disable escaping URLs in actions in the meta content attribute which\\n    follow \u0026quot;url=\u0026quot; by setting htmlmetacontenturlescape=0.\\n\\n    This is CVE-2026-27142 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * net/url: reject IPv6 literal not at start of host\\n\\n    The Go standard library function net/url.Parse insufficiently\\n    validated the host/authority component and accepted some invalid URLs\\n    by effectively treating garbage before an IP-literal as ignorable.\\n    The function should have rejected this as invalid.\\n\\n    To prevent this behavior, net/url.Parse now rejects IPv6 literals\\n    that do not appear at the start of the host subcomponent of a URL.\\n\\n    Thanks to Masaki Hara (\u0026apos;, \u0026apos;) of Wantedly.\\n\\n    This is CVE-2026-25679 and Go issue\u0026apos;, \u0026apos;.\\n\\n  * os: FileInfo can escape from a Root\\n\\n    On Unix platforms, when listing the contents of a directory using\\n    File.ReadDir or File.Readdir the returned FileInfo could reference\\n    a file outside of the Root in which the File was opened.\\n\\n    The contents of the FileInfo were populated using the lstat system\\n    call, which takes the path to the file as a parameter. If a component\\n    of the full path of the file described by the FileInfo is replaced with\\n    a symbolic link, the target of the lstat can be directed to another\\n    location on the filesystem.\\n\\n    The impact of this escape is limited to reading metadata provided by\\n    lstat from arbitrary locations on the filesystem. This could be used\\n    to p(CVE-2026-25679)\n\nWhen verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.(CVE-2026-27137)\n\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic(CVE-2026-27141)\n\nDuring chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)\n\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-32281)\n\nOn Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.(CVE-2026-32282)\n\nWhen verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.(CVE-2026-33810)\n\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.(CVE-2026-33811)\n\nA vulnerability was found in the encoding/asn1 package in Go. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.(CVE-2026-33818)\n\nWhen returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.(CVE-2026-42507)\n\nParsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.(CVE-2026-46600)\n\nWhen a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.(CVE-2026-56853)\n\nA flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, causing the depth counter to reset and never fire, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.(CVE-2026-56859)\n\nHandshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.(CVE-2026-56862)","status":"published","published":"2026-09-25T01:28:01Z","modified":"2026-09-25T01:45:11.310843798Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2025:11462","title":"Red Hat Security Advisory: git security update","status":"published","published":"2025-07-22T10:03:22Z","modified":"2026-10-17T10:04:46Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11533","title":"Red Hat Security Advisory: git security update","status":"published","published":"2025-07-23T10:02:49Z","modified":"2026-10-17T10:04:46Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11534","title":"Red Hat Security Advisory: git security update","status":"published","published":"2025-07-24T10:14:33Z","modified":"2026-10-17T10:04:47Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11686","title":"Red Hat Security Advisory: git security update","status":"published","published":"2025-07-25T10:06:23Z","modified":"2026-10-14T10:07:00Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11794","title":"Red Hat Security Advisory: git security update","status":"published","published":"2025-07-28T10:03:05Z","modified":"2026-10-14T10:07:02Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11795","title":"Red Hat Security Advisory: git security update","status":"published","published":"2025-07-28T10:03:06Z","modified":"2026-10-14T10:07:02Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:11462","title":"Important: git security update","description":"Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)\n\n* git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)\n\n* git: Git arbitrary code execution (CVE-2025-48384)\n\n* git: Git arbitrary file writes (CVE-2025-48385)\n\n* gitk: Git file creation flaw (CVE-2025-27613)\n\n* gitk: git script execution flaw (CVE-2025-27614)\n\n* git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:40:05.334016Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2025:11534","title":"Important: git security update","description":"Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.\n\nSecurity Fix(es):\n\n* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)\n\n* git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)\n\n* git: Git arbitrary code execution (CVE-2025-48384)\n\n* git: Git arbitrary file writes (CVE-2025-48385)\n\n* gitk: Git file creation flaw (CVE-2025-27613)\n\n* gitk: git script execution flaw (CVE-2025-27614)\n\n* git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:28.481174Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2025-48385","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T17:00:00Z","modified":"2026-02-04T02:45:37.112116Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"ALSA-2025:11462","title":"Important: git security update","description":"Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.  \n\nSecurity Fix(es):  \n\n  * git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)\n  * git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)\n  * git: Git arbitrary code execution (CVE-2025-48384)\n  * git: Git arbitrary file writes (CVE-2025-48385)\n  * gitk: Git file creation flaw (CVE-2025-27613)\n  * gitk: git script execution flaw (CVE-2025-27614)\n  * git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-10-29T11:32:26.498317277Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:11533","title":"Important: git security update","description":"Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.  \n\nSecurity Fix(es):  \n\n  * git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)\n  * git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)\n  * git: Git arbitrary code execution (CVE-2025-48384)\n  * git: Git arbitrary file writes (CVE-2025-48385)\n  * gitk: Git file creation flaw (CVE-2025-27613)\n  * gitk: git script execution flaw (CVE-2025-27614)\n  * git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-22T00:00:00Z","modified":"2026-10-29T11:30:06.203220059Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:11534","title":"Important: git security update","description":"Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.  \n\nSecurity Fix(es):  \n\n  * git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349)\n  * git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006)\n  * git: Git arbitrary code execution (CVE-2025-48384)\n  * git: Git arbitrary file writes (CVE-2025-48385)\n  * gitk: Git file creation flaw (CVE-2025-27613)\n  * gitk: git script execution flaw (CVE-2025-27614)\n  * git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-07-22T00:00:00Z","modified":"2026-10-29T11:02:26.317790485Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-65040","title":"CVE-2025-48385 affecting package git for versions less than 2.45.4-1","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T19:15:43Z","modified":"2026-04-21T04:50:02.369103Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"AZL-65051","title":"CVE-2025-48385 affecting package git for versions less than 2.40.4-2","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-08T19:15:43Z","modified":"2026-04-21T04:32:38.973391Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BELL-CVE-2025-48385","status":"published","published":"2025-07-09T06:00:04.61956Z","modified":"2026-01-26T09:40:29.301812Z","updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"BIT-git-2025-48385","title":"Git alllows arbitrary file writes via bundle-uri parameter injection","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","status":"published","published":"2025-07-10T05:40:40.066Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"CLSA-2025-1752576917","title":"git: Fix of CVE-2025-48385","description":"- CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter\n  injection","status":"published","published":"2025-07-15T10:55:21Z","modified":"2026-06-01T00:32:59.255769244Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1753729385","title":"git: Fix of CVE-2025-48385","description":"- CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter injection","status":"published","published":"2025-07-28T19:03:09Z","modified":"2026-06-01T00:30:44.880710272Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"openSUSE-SU-2025:15337-1","title":"git-2.50.1-1.1 on GA media","description":"These are all security issues fixed in the git-2.50.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-11T00:00:00Z","modified":"2026-02-04T02:54:26.771753Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-48385","title":"CVE-2025-48385 in rootio-git - Patched by Root","description":"Root has patched CVE-2025-48385 in the rootio-git package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2025-09-10T10:41:30Z","modified":"2026-02-13T03:21:17.239815Z","updated_at":"2026-11-02T15:53:31.514195Z"},{"id":"SUSE-SU-2025:03012-1","title":"security update for git, git-lfs, obs-scm-bridge, python-PyYAML","description":"This update for git, git-lfs, obs-scm-bridge, python-PyYAML fixes the following issues:\n\ngit was updated from version 2.43.0 to 2.51.0 (bsc#1243197):\n\n- Security issues fixed:\n\n  * CVE-2025-27613 Fixed arbitrary writable file creation and truncation in Gitk(bsc#1245938)\n  * CVE-2025-27614 Fixed arbitrary script execution via repository clonation in gitk(bsc#1245939)\n  * CVE-2025-46835 Fixed arbitrary writable file creation in Git GUI when untrusted repository is cloned (bsc#1245942)\n  * CVE-2025-48384 Fixed the unintentional execution of a script after checkout due to CRLF transforming (bsc#1245943)\n  * CVE-2025-48385 Fixed arbitrary code execution due to protocol injection via fetching advertised bundle(bsc#1245946)\n\n- Other changes and bugs fixed:\n    \n- Other changes and bugs fixed:\n    \n  * Added SHA256 support (bsc#1243197)\n  * Git moved to /usr/libexec/git/git and updated AppArmor profile\n    accordingly (bsc#1218588)\n  * gitweb AppArmor profile: allow reading etc/gitweb-common.conf (bsc#1218664)\n  * Do not replace apparmor configuration  (bsc#1216545)\n  * Fixed the Python version required (bsc#1212476)\n    \n- Version Updates Release Notes:\n\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.51.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.50.1.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.50.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.49.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.48.1.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.48.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.47.1.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.47.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.46.2.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.46.1.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.46.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.45.3.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.45.2.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.45.1.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.45.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.44.0.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.3.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.2.adoc\n  * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.43.1.adoc\n\ngit-lfs is included in version 3.7.0.\n\npython-PyYAML was updated from version 6.0.1 to 6.0.2:\n\n- Added support for Cython 3.x and Python 3.13\n\nobs-scm-bridge was updated from version 0.5.4 to 0.7.4:\n\n- New Features and Improvements:\n\n  * Manifest File Support: Support has been added for a `_manifest file`, which serves as a successor to the `_subdirs`\n    file.\n  * Control Over Git Information: A new noobsinfo query parameter was added to hide git information in source and binary\n    files.\n  * Enhanced Submodule Handling: The system now records the configured branch of submodules and stays on that branch\n    during checkout.\n  * Git SHA Tracking: In project mode, the tool now uses git SHA sums instead of md5sum to track package sources.\n  * SSH URL Support: ssh:// SCM URLs can now be used.\n  * Improved Error Messages: Error reporting for invalid files within package subdirectories has been improved.\n  * Standardized Config Location: In project mode, the _config file is now always located in the top-level directory,\n    even when using subdirs.\n  * Reduced Unnecessary Changes: In project mode, unnecessary modifications to the package meta URL are now avoided.\n  * Limit Asset Handling: A new mechanism has been introduced to limit how assets are handled.\n  * Branch Information Export: The trackingbranch is now exported to scmsync.obsinfo.\n\n- Bugs fixed:\n\n  * Syntax Fix: A syntax issue was corrected.\n  * Git Submodule Parsing: The .gitsubmodule parser was fixed to correctly handle files that contain a mix of spaces and\n    tabs.\n","status":"published","published":"2025-08-29T00:07:40Z","modified":"2026-02-04T03:00:43.62725Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03037-1","title":"Security update for git","description":"This update for git fixes the following issues:\n\nUpdated to 2.43.7 (jsc#PED-13447):\n\n- CVE-2025-27613: Fixed arbitrary writable file creation and truncation in Gitk (bsc#1245938)\n- CVE-2025-27614: Fixed arbitrary script execution via repo clonation in Gitk (bsc#1245939)\n- CVE-2025-46835: Fixed arbitrary writable file creation via untrusted repository clonation in Git GUI (bsc#1245942)\n- CVE-2025-48384: Fixed arbitrary writable file creation when cloning untrusted repositories with submodules\n  using the --recursive flag (bsc#1245943)\n- CVE-2025-48385: Fixed arbitrary code execution due to protocol injection via fetching advertised bundle (bsc#1245946)\n\nOther fixes:\n\n- Drop git-credential-gnome-keyring package as it was dropped upstream,\n  use git-credential-libsecret instead\n- git-add--interactive was removed upstream in favor of built in implementation,\n  which was already the default in SLE.\n","status":"published","published":"2025-09-01T12:45:59Z","modified":"2026-03-23T04:47:01.149895Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20721-1","title":"Security update for git","description":"This update for git fixes the following issues:\n\n- Update to 2.51.0\n  \n  - UI, Workflows \u0026 Features\n    - Userdiff patterns for the R language have been added.\n    - Documentation for \"git send-email\" has been updated with a\n      bit more credential helper and OAuth information.\n    - \"git cat-file --batch\" learns to understand %(objectmode)\n      atom to allow the caller to tell missing objects (due to\n      repository corruption) and submodules (whose commit objects\n      are OK to be missing) apart.\n    - \"git diff --no-index dirA dirB\" can limit the comparison with\n      pathspec at the end of the command line, just like normal\n      \"git diff\".\n    - \"git subtree\" (in contrib/) learned to grok GPG signing its\n      commits.\n    - \"git whatchanged\" that is longer to type than \"git log --raw\"\n      which is its modern rough equivalent has outlived its\n      usefulness more than 10 years ago.  Plan to deprecate and\n      remove it.\n    - An interchange format for stash entries is defined, and\n      subcommand of \"git stash\" to import/export has been added.\n    - \"git merge/pull\" has been taught the \"--compact-summary\"\n      option to use the compact-summary format, intead of diffstat,\n      when showing the summary of the incoming changes.\n    - \"git imap-send\" has been broken for a long time, which has\n      been resurrected and then taught to talk OAuth2.0 etc.\n    - Some error messages from \"git imap-send\" has been updated.\n    - When \"git daemon\" sees a signal while attempting to accept()\n      a new client, instead of retrying, it skipped it by mistake,\n      which has been corrected.\n    - The reftable ref backend has matured enough; Git 3.0 will\n      make it the default format in a newly created repositories by\n      default.\n    - \"netrc\" credential helper has been improved to understand\n      textual service names (like smtp) in addition to the numeric\n      port numbers (like 25).\n    - Lift the limitation to use changed-path filter in \"git log\"\n      so that it can be used for a pathspec with multiple literal\n      paths.\n    - Clean up the way how signature on commit objects are exported\n      to and imported from fast-import stream.\n    - Remove unsupported, unused, and unsupportable old option from\n      \"git log\".\n    - Document recently added \"git imap-send --list\" with an\n      example.\n    - \"git pull\" learned to pay attention to pull.autostash\n      configuration variable, which overrides\n      rebase/merge.autostash.\n    - \"git for-each-ref\" learns \"--start-after\" option to help\n      applications that want to page its output.\n    - \"git switch\" and \"git restore\" are declared to be no longer\n      experimental.\n    - \"git -c alias.foo=bar foo -h baz\" reported \"'foo' is aliased\n      to 'bar'\" and then went on to run \"git foo -h baz\", which was\n      unexpected.  Tighten the rule so that alias expansion is\n      reported only when \"-h\" is the sole option.\n  - Performance, Internal Implementation, Development Support etc.\n    - \"git pack-objects\" learned to find delta bases from blobs at\n      the same path, using the --path-walk API.\n    - CodingGuidelines update.\n    - Add settings for Solaris 10 \u0026 11.\n    - Meson-based build/test framework now understands TAP output\n      generated by our tests.\n    - \"Do not explicitly initialize to zero\" rule has been\n      clarified in the CodingGuidelines document.\n    - A test helper \"test_seq\" function learned the \"-f \u003cfmt\u003e\"\n      option, which allowed us to simplify a lot of test scripts.\n    - A lot of stale stuff has been removed from the contrib/\n      hierarchy.\n    - \"git push\" and \"git fetch\" are taught to update refs in\n      batches to gain performance.\n    - Some code paths in \"git prune\" used to ignore the passed-in\n      repository object and used the `the_repository` singleton\n      instance instead, which has been corrected.\n    - Update \".clang-format\" and \".editorconfig\" to match our style\n      guide a bit better.\n    - \"make coccicheck\" succeeds even when spatch made suggestions,\n      which has been updated to fail in such a case.\n    - Code clean-up around object access API.\n    - Define .precision to more canned parse-options type to avoid\n      bugs coming from using a variable with a wrong type to\n      capture the parsed values.\n    - Flipping the default hash function to SHA-256 at Git 3.0\n      boundary is planned.\n    - Declare weather-balloon we raised for \"bool\" type 18 months\n      ago a success and officially allow using the type in our\n      codebase.\n    - GIT_TEST_INSTALLED was not honored in the recent topic\n      related to SHA256 hashes, which has been corrected.\n    - The pop_most_recent_commit() function can have quite\n      expensive worst case performance characteristics, which has\n      been optimized by using prio-queue data structure.\n    - Move structure definition from unrelated header file to where\n      it belongs.\n    - To help our developers, document what C99 language features\n      are being considered for adoption, in addition to what past\n      experiments have already decided.\n    - The reftable unit tests are now ported to the \"clar\" unit\n      testing framework.\n    - Redefine where the multi-pack-index sits in the object\n      subsystem, which recently was restructured to allow multiple\n      backends that support a single object source that belongs to\n      one repository.  A MIDX does span multiple \"object sources\".\n    - Reduce implicit assumption and dependence on the_repository\n      in the object-file subsystem.\n\n  - Fixes since v2.50 Unless otherwise noted, all the changes in\n    2.50.X maintenance track, including security updates, are\n    included in this release.\n    - A memory-leak in an error code path has been plugged.\n    - Some leftover references to documentation source files that\n      no longer exist, due to recent \".txt\" -\u003e \".adoc\" renaming,\n      have been corrected.\n    - \"git stash -p \u003cpathspec\u003e\" improvements. \n    - \"git send-email\" incremented its internal message counter\n      when a message was edited, which made logic that treats the\n      first message specially misbehave, which has been corrected.\n    - \"git stash\" recorded a wrong branch name when submodules are\n      present in the current checkout, which has been corrected.\n    - When asking to apply mailmap to both author and committer\n      field while showing a commit object, the field that appears\n      later was not correctly parsed and replaced, which has been\n      corrected.\n    - \"git maintenance\" lacked the care \"git gc\" had to avoid\n      holding onto the repository lock for too long during packing\n      refs, which has been remedied.\n    - Avoid regexp_constraint and instead use comparison_constraint\n      when listing functions to exclude from application of\n      coccinelle rules, as spatch can be built with different\n      regexp engine X-\u003c.\n    - Updating submodules from the upstream did not work well when\n      submodule's HEAD is detached, which has been improved. \n    - Remove unnecessary check from \"git daemon\" code. (merge\n      0c856224d2 cb/daemon-fd-check-fix later to maint).\n    - Use of sysctl() system call to learn the total RAM size used\n      on BSDs has been corrected.\n    - Drop FreeBSD 4 support and declare that we support only\n      FreeBSD 12 or later, which has memmem() supported.\n    - A diff-filter with negative-only specification like \"git log\n      --diff-filter=d\" did not trigger correctly, which has been\n      fixed.\n    - A failure to open the index file for writing due to\n      conflicting access did not state what went wrong, which has\n      been corrected.\n    - Tempfile removal fix in the codepath to sign commits with SSH\n      keys.\n    - Code and test clean-up around string-list API.\n    - \"git apply -N\" should start from the current index and\n      register only new files, but it instead started from an empty\n      index, which has been corrected.\n    - Leakfix with a new and a bit invasive test on pack-bitmap\n      files.\n    - \"git fetch --prune\" used to be O(n^2) expensive when there\n      are many refs, which has been corrected.\n    - When a ref creation at refs/heads/foo/bar fails, the files\n      backend now removes refs/heads/foo/ if the directory is\n      otherwise not used.\n    - \"pack-objects\" has been taught to avoid pointing into objects\n      in cruft packs from midx.\n    - \"git remote\" now detects remote names that overlap with each\n      other (e.g., remote nickname \"outer\" and \"outer/inner\" are\n      used at the same time), as it will lead to overlapping\n      remote-tracking branches.\n    - The gpg.program configuration variable, which names a\n      pathname to the (custom) GPG compatible program, can now be\n      spelled with ~tilde expansion.\n    - Our \u003csane-ctype.h\u003e header file relied on that the\n      system-supplied \u003cctype.h\u003e header is not later included, which\n      would override our macro definitions, but \"amazon linux\"\n      broke this assumption.  Fix this by preemptively including\n      \u003cctype.h\u003e near the beginning of \u003csane-ctype.h\u003e ourselves.\n      (merge 9d3b33125f ps/sane-ctype-workaround later to maint).\n    - Clean-up compat/bswap.h mess. (merge f4ac32c03a\n      ss/compat-bswap-revamp later to maint).\n    - Meson-based build did not handle libexecdir setting\n      correctly, which has been corrected. (merge 056dbe8612\n      rj/meson-libexecdir-fix later to maint).\n    - Document that we do not require \"real\" name when signing your\n      patches off. (merge 1f0fed312a\n      bc/contribution-under-non-real-names later to maint).\n    - \"git commit\" that concludes a conflicted merge failed to\n      notice and remove existing comment added automatically (like\n      \"# Conflicts:\") when the core.commentstring is set to 'auto'.\n      (merge 92b7c7c9f5 ac/auto-comment-char-fix later to maint).\n    - \"git rebase -i\" with bogus rebase.instructionFormat\n      configuration failed to produce the todo file after recording\n      the state files, leading to confused \"git status\"; this has\n      been corrected. (merge ade14bffd7\n      ow/rebase-verify-insn-fmt-before-initializing-state later to\n      maint).\n    - A few file descriptors left unclosed upon program completion\n      in a few test helper programs are now closed. (merge\n      0f1b33815b hl/test-helper-fd-close later to maint).\n    - Interactive prompt code did not correctly strip CRLF from the\n      end of line on Windows. (merge 711a20827b js/prompt-crlf-fix\n      later to maint).\n    - The config API had a set of convenience wrapper functions\n      that implicitly use the_repository instance; they have been\n      removed and inlined at the calling sites.\n    - \"git add/etc -p\" now honor the diff.context configuration\n      variable, and also they learn to honor the -U\u003cn\u003e command-line\n      option. (merge 2b3ae04011 lm/add-p-context later to maint).\n    - The case where a new submodule takes a path where there used\n      to be a completely different subproject is now dealt with a\n      bit better than before. (merge 5ed8c5b465\n      kj/renamed-submodule later to maint).\n    - The deflate codepath in \"git archive --format=zip\" had a\n      longstanding bug coming from misuse of zlib API, which has\n      been corrected.\n\n\n- Update to 2.50.1:\n  \n  * CVE-2025-27613: Fixed arbitrary writable file creation and \n    truncation in Gitk (bsc#1245938)\n  * CVE-2025-27614: Fixed arbitrary script execution via repo \n    clonation in gitk (bsc#1245939)\n  * CVE-2025-46835: Fixed untrusted repository cloning leading \n    to arbitrary writable file creation in Git GUI (bsc#1245942)\n  * CVE-2025-48384: Fixed CRLF transforming (bsc#1245943)\n  * CVE-2025-48385: Fixed arbitrary code execution due to protocol \n    injection (bsc#1245946)\n  * CVE-2025-48386: Fixed buffer overflow in static buffer (bsc#1245947)\n\n- Update to 2.48.1:\n  \n  * CVE-2024-50349: Fixed password leak (bsc#1235600)\n  * CVE-2024-52006: Fixed Carriage Returns via the credential \n    protocol to credential helpers (bsc#1235601)\n\n- Update to 2.48.0:\n\n  * Reference consistency checks: git refs verify\n  * Reflogs can now be migrated with git refs migrate\n  * git is free of memory leaks as covered by the test suite\n  * Performance improvements\n\n- Update to 2.47.1:\n\n  * Use after free and double freeing at the end in\n    \"git log -L... -p\" had been identified and fixed.\n  * \"git maintenance start\" crashed due to an uninitialized\n    variable reference, which has been corrected.\n  * Fail gracefully instead of crashing when attempting to write\n    the contents of a corrupt in-core index as a tree object.\n  * A \"git fetch\" from the superproject going down to a submodule\n    used a wrong remote when the default remote names are set\n    differently between them.\n  * The \"gitk\" project tree has been synchronized again\n\n- Update to 2.47.0:\n  \n * A few descriptions in \"git show-ref -h\" have been clarified.\n * A 'P' command to \"git add -p\" that passes the patch hunk to the\n   pager has been added.\n * \"git grep -W\" omits blank lines that follow the found function at\n   the end of the file, just like it omits blank lines before the next\n   function.\n * The value of http.proxy can have \"path\" at the end for a socks\n   proxy that listens to a unix-domain socket, but we started to\n   discard it when we taught proxy auth code path to use the\n   credential helpers, which has been corrected.\n * The code paths to compact multiple reftable files have been updated\n   to correctly deal with multiple compaction triggering at the same\n   time.\n * Support to specify ref backend for submodules has been enhanced.\n * \"git svn\" has been taught about svn:global-ignores property\n   recent versions of Subversion has.\n * The default object hash and ref backend format used to be settable\n   only with explicit command line option to \"git init\" and\n   environment variables, but now they can be configured in the user's\n   global and system wide configuration.\n * \"git send-email\" learned \"--translate-aliases\" option that reads\n   addresses from the standard input and emits the result of applying\n   aliases on them to the standard output.\n * 'git for-each-ref' learned a new \"--format\" atom to find the branch\n   that the history leading to a given commit \"%(is-base:\u003ccommit\u003e)\" is\n   likely based on.\n * The command line prompt support used to be littered with bash-isms,\n   which has been corrected to work with more shells.\n * Support for the RUNTIME_PREFIX feature has been added to z/OS port.\n * \"git send-email\" learned \"--mailmap\" option to allow rewriting the\n   recipient addresses.\n * \"git mergetool\" learned to use VSCode as a merge backend.\n * \"git pack-redundant\" has been marked for removal in Git 3.0.\n * One-line messages to \"die\" and other helper functions will get LF\n   added by these helper functions, but many existing messages had an\n   unnecessary LF at the end, which have been corrected.\n * The \"scalar clone\" command learned the \"--no-tags\" option.\n * The environment GIT_ADVICE has been intentionally kept undocumented\n   to discourage its use by interactive users.  Add documentation to\n   help tool writers.\n * \"git apply --3way\" learned to take \"--ours\" and other options.\n\n- Update to version 2.46.2:\n  \n  * Revert the \"git patch-id\" change that went into 2.46.1,\n    as it seems to have got a regression reported (I haven't verified,\n    but it is better to keep a known breakage than adding an unintended\n    regression).\n  * In a few corner cases \"git diff --exit-code\" failed to report\n    \"changes\" (e.g., renamed without any content change), which has\n    been corrected.\n  * The interpret-trailers command failed to recognise the end of the\n    message when the commit log ends in an incomplete line.\n\n- Update to version 2.46.1;\n  \n  * \"git checkout --ours\" (no other arguments) complained that the\n    option is incompatible with branch switching, which is technically\n    correct, but found confusing by some users.  It now says that the\n    user needs to give pathspec to specify what paths to checkout.\n  * It has been documented that we avoid \"VAR=VAL shell_func\" and why.\n  * \"git add -p\" by users with diff.suppressBlankEmpty set to true\n    failed to parse the patch that represents an unmodified empty line\n    with an empty line (not a line with a single space on it), which\n    has been corrected.\n  * \"git rebase --help\" referred to \"offset\" (the difference between\n    the location a change was taken from and the change gets replaced)\n    incorrectly and called it \"fuzz\", which has been corrected.\n  * \"git notes add -m '' --allow-empty\" and friends that take prepared\n    data to create notes should not invoke an editor, but it started\n    doing so since Git 2.42, which has been corrected.\n  * An expensive operation to prepare tracing was done in re-encoding\n    code path even when the tracing was not requested, which has been\n    corrected.\n  * Perforce tests have been updated.\n  * The credential helper to talk to OSX keychain sometimes sent\n    garbage bytes after the username, which has been corrected.\n  * A recent update broke \"git ls-remote\" used outside a repository,\n    which has been corrected.\n  * \"git config --value=foo --fixed-value section.key newvalue\" barfed\n    when the existing value in the configuration file used the\n    valueless true syntax, which has been corrected.\n  * \"git reflog expire\" failed to honor annotated tags when computing\n   reachable commits.\n  * A flakey test and incorrect calls to strtoX() functions have been\n    fixed.\n  * Follow-up on 2.45.1 regression fix.\n  * \"git rev-list ... | git diff-tree -p --remerge-diff --stdin\" should\n    behave more or less like \"git log -p --remerge-diff\" but instead it\n    crashed, forgetting to prepare a temporary object store needed.\n  * The patch parser in \"git patch-id\" has been tightened to avoid\n    getting confused by lines that look like a patch header in the log\n    message.\n  * \"git bundle unbundle\" outside a repository triggered a BUG()\n    unnecessarily, which has been corrected.\n  * The code forgot to discard unnecessary in-core commit buffer data\n    for commits that \"git log --skip=\u003cnumber\u003e\" traversed but omitted\n    from the output, which has been corrected.\n  * \"git verify-pack\" and \"git index-pack\" started dying outside a\n    repository, which has been corrected.\n  * A corner case bug in \"git stash\" was fixed.\n\n- Change less requirement to path to allow for use with BusyBox\n\n- Update to 2.46.0\n  \n  UI, Workflows \u0026 Features\n   * The \"--rfc\" option of \"git format-patch\" learned to take an\n     optional string value to be used in place of \"RFC\" to tweak the\n     \"[PATCH]\" on the subject header.\n   * The credential helper protocol, together with the HTTP layer, have\n     been enhanced to support authentication schemes different from\n     username \u0026 password pair, like Bearer and NTLM.\n   * Command line completion script (in contrib/) learned to complete\n     \"git symbolic-ref\" a bit better (you need to enable plumbing\n     commands to be completed with GIT_COMPLETION_SHOW_ALL_COMMANDS).\n   * When the user responds to a prompt given by \"git add -p\" with an\n     unsupported command, list of available commands were given, which\n     was too much if the user knew what they wanted to type but merely\n     made a typo.  Now the user gets a much shorter error message.\n   * The color parsing code learned to handle 12-bit RGB colors, spelled\n     as \"#RGB\" (in addition to \"#RRGGBB\" that is already supported).\n   * The operation mode options (like \"--get\") the \"git config\" command\n     uses have been deprecated and replaced with subcommands (like \"git\n     config get\").\n   * \"git tag\" learned the \"--trailer\" option to futz with the trailers\n     in the same way as \"git commit\" does.\n   * A new global \"--no-advice\" option can be used to disable all advice\n     messages, which is meant to be used only in scripts.\n   * Updates to symbolic refs can now be made as a part of ref\n     transaction.\n   * The trailer API has been reshuffled a bit.\n   * Terminology to call various ref-like things are getting\n     straightened out.\n   * The command line completion script (in contrib/) has been adjusted\n     to the recent update to \"git config\" that adopted subcommand based\n     UI.\n   * The knobs to tweak how reftable files are written have been made\n     available as configuration variables.\n   * When \"git push\" notices that the commit at the tip of the ref on\n     the other side it is about to overwrite does not exist locally, it\n     used to first try fetching it if the local repository is a partial\n     clone. The command has been taught not to do so and immediately\n     fail instead.\n   * The promisor.quiet configuration knob can be set to true to make\n     lazy fetching from promisor remotes silent.\n   * The inter/range-diff output has been moved to the end of the patch\n     when format-patch adds it to a single patch, instead of writing it\n     before the patch text, to be consistent with what is done for a\n     cover letter for a multi-patch series.\n   * A new command has been added to migrate a repository that uses the\n     files backend for its ref storage to use the reftable backend, with\n     limitations.\n   * \"git diff --exit-code --ext-diff\" learned to take the exit status\n     of the external diff driver into account when deciding the exit\n     status of the overall \"git diff\" invocation when configured to do\n     so.\n   * \"git update-ref --stdin\" learned to handle transactional updates of\n     symbolic-refs.\n   * \"git format-patch --interdiff\" for multi-patch series learned to\n     turn on cover letters automatically (unless told never to enable\n     cover letter with \"--no-cover-letter\" and such).\n   * The \"--heads\" option of \"ls-remote\" and \"show-ref\" has been been\n     deprecated; \"--branches\" replaces \"--heads\".\n   * For over a year, setting add.interactive.useBuiltin configuration\n     variable did nothing but giving a \"this does not do anything\"\n     warning.  The warning has been removed.\n   * The http transport can now be told to send request with\n     authentication material without first getting a 401 response.\n   * A handful of entries are added to the GitFAQ document.\n   * \"git var GIT_SHELL_PATH\" should report the path to the shell used\n     to spawn external commands, but it didn't do so on Windows, which\n     has been corrected.\n  Performance, Internal Implementation, Development Support etc.\n   * Advertise \"git contacts\", a tool for newcomers to find people to\n     ask review for their patches, a bit more in our developer\n     documentation.\n   * In addition to building the objects needed, try to link the objects\n     that are used in fuzzer tests, to make sure at least they build\n     without bitrot, in Linux CI runs.\n   * Code to write out reftable has seen some optimization and\n     simplification.\n   * Tests to ensure interoperability between reftable written by jgit\n     and our code have been added and enabled in CI.\n   * The singleton index_state instance \"the_index\" has been eliminated\n     by always instantiating \"the_repository\" and replacing references\n     to \"the_index\"  with references to its .index member.\n   * Git-GUI has a new maintainer, Johannes Sixt.\n   * The \"test-tool\" has been taught to run testsuite tests in parallel,\n     bypassing the need to use the \"prove\" tool.\n   * The \"whitespace check\" task that was enabled for GitHub Actions CI\n     has been ported to GitLab CI.\n   * The refs API lost functions that implicitly assumes to work on the\n     primary ref_store by forcing the callers to pass a ref_store as an\n     argument.\n   * Code clean-up to reduce inter-function communication inside\n     builtin/config.c done via the use of global variables.\n   * The pack bitmap code saw some clean-up to prepare for a follow-up topic.\n   * Preliminary code clean-up for \"git send-email\".\n   * The default \"creation-factor\" used by \"git format-patch\" has been\n     raised to make it more aggressively find matching commits.\n   * Before discovering the repository details, We used to assume SHA-1\n     as the \"default\" hash function, which has been corrected. Hopefully\n     this will smoke out codepaths that rely on such an unwarranted\n     assumptions.\n   * The project decision making policy has been documented.\n   * The strcmp-offset tests have been rewritten using the unit test\n     framework.\n   * \"git add -p\" learned to complain when an answer with more than one\n     letter is given to a prompt that expects a single letter answer.\n   * The alias-expanded command lines are logged to the trace output.\n   * A new test was added to ensure git commands that are designed to\n     run outside repositories do work.\n   * A few tests in reftable library have been rewritten using the\n     unit test framework.\n   * A pair of test helpers that essentially are unit tests on hash\n     algorithms have been rewritten using the unit-tests framework.\n   * A test helper that essentially is unit tests on the \"decorate\"\n     logic has been rewritten using the unit-tests framework.\n   * Many memory leaks in the sparse-checkout code paths have been\n     plugged.\n   * \"make check-docs\" noticed problems and reported to its output but\n     failed to signal its findings with its exit status, which has been\n     corrected.\n   * Building with \"-Werror -Wwrite-strings\" is now supported.\n   * To help developers, the build procedure now allows builders to use\n     CFLAGS_APPEND to specify additional CFLAGS.\n   * \"oidtree\" tests were rewritten to use the unit test framework.\n   * The structure of the document that records longer-term project\n     decisions to deprecate/remove/update various behaviour has been\n     outlined.\n   * The pseudo-merge reachability bitmap to help more efficient storage\n     of the reachability bitmap in a repository with too many refs has\n     been added.\n   * When \"git merge\" sees that the index cannot be refreshed (e.g. due\n     to another process doing the same in the background), it died but\n     after writing MERGE_HEAD etc. files, which was useless for the\n     purpose to recover from the failure.\n   * The output from \"git cat-file --batch-check\" and \"--batch-command\n     (info)\" should not be unbuffered, for which some tests have been\n     added.\n   * A CPP macro USE_THE_REPOSITORY_VARIABLE is introduced to help\n     transition the codebase to rely less on the availability of the\n     singleton the_repository instance.\n   * \"git version --build-options\" reports the version information of\n     OpenSSL and other libraries (if used) in the build.\n   * Memory ownership rules for the in-core representation of\n     remote.*.url configuration values have been straightened out, which\n     resulted in a few leak fixes and code clarification.\n   * When bundleURI interface fetches multiple bundles, Git failed to\n     take full advantage of all bundles and ended up slurping duplicated\n     objects, which has been corrected.\n   * The code to deal with modified paths that are out-of-cone in a\n     sparsely checked out working tree has been optimized.\n   * An existing test of oidmap API has been rewritten with the\n     unit-test framework.\n   * The \"ort\" merge backend saw one bugfix for a crash that happens\n     when inner merge gets killed, and assorted code clean-ups.\n   * A new warning message is issued when a command has to expand a\n     sparse index to handle working tree cruft that are outside of the\n     sparse checkout.\n   * The test framework learned to take the test body not as a single\n     string but as a here-document.\n   * \"git push '' HEAD:there\" used to hit a BUG(); it has been corrected\n     to die with \"fatal: bad repository ''\".\n   * What happens when http.cookieFile gets the special value \"\" has\n     been clarified in the documentation.\n  Fixes\n   * \"git rebase --signoff\" used to forget that it needs to add a\n     sign-off to the resulting commit when told to continue after a\n     conflict stops its operation.\n   * The procedure to build multi-pack-index got confused by the\n     replace-refs mechanism, which has been corrected by disabling the\n     latter.\n   * The \"-k\" and \"--rfc\" options of \"format-patch\" will now error out\n     when used together, as one tells us not to add anything to the\n     title of the commit, and the other one tells us to add \"RFC\" in\n     addition to \"PATCH\".\n   * \"git stash -S\" did not handle binary files correctly, which has\n     been corrected.\n   * A scheduled \"git maintenance\" job is expected to work on all\n     repositories it knows about, but it stopped at the first one that\n     errored out.  Now it keeps going.\n   * zsh can pretend to be a normal shell pretty well except for some\n     glitches that we tickle in some of our scripts. Work them around\n     so that \"vimdiff\" and our test suite works well enough with it.\n   * Command line completion support for zsh (in contrib/) has been\n     updated to stop exposing internal state to end-user shell\n     interaction.\n   * Tests that try to corrupt in-repository files in chunked format did\n     not work well on macOS due to its broken \"mv\", which has been\n     worked around.\n   * The maximum size of attribute files is enforced more consistently.\n   * Unbreak CI jobs so that we do not attempt to use Python 2 that has\n     been removed from the platform.\n   * Git 2.43 started using the tree of HEAD as the source of attributes\n     in a bare repository, which has severe performance implications.\n     For now, revert the change, without ripping out a more explicit\n     support for the attr.tree configuration variable.\n   * The \"--exit-code\" option of \"git diff\" command learned to work with\n     the \"--ext-diff\" option.\n   * Windows CI running in GitHub Actions started complaining about the\n     order of arguments given to calloc(); the imported regex code uses\n     the wrong order almost consistently, which has been corrected.\n   * Expose \"name conflict\" error when a ref creation fails due to D/F\n     conflict in the ref namespace, to improve an error message given by\n     \"git fetch\".\n     (merge 9339fca23e it/refs-name-conflict later to maint).\n   * The SubmittingPatches document now refers folks to manpages\n     translation project.\n   * The documentation for \"git diff --name-only\" has been clarified\n     that it is about showing the names in the post-image tree.\n   * The credential helper that talks with osx keychain learned to avoid\n     storing back the authentication material it just got received from\n     the keychain.\n     (merge e1ab45b2da kn/osxkeychain-skip-idempotent-store later to maint).\n   * The chainlint script (invoked during \"make test\") did nothing when\n     it failed to detect the number of available CPUs.  It now falls\n     back to 1 CPU to avoid the problem.\n   * Revert overly aggressive \"layered defence\" that went into 2.45.1\n     and friends, which broke \"git-lfs\", \"git-annex\", and other use\n     cases, so that we can rebuild necessary counterparts in the open.\n   * \"git init\" in an already created directory, when the user\n     configuration has includeif.onbranch, started to fail recently,\n     which has been corrected.\n   * Memory leaks in \"git mv\" has been plugged.\n   * The safe.directory configuration knob has been updated to\n     optionally allow leading path matches.\n   * An overly large \".gitignore\" files are now rejected silently.\n   * Upon expiration event, the credential subsystem forgot to clear\n     in-core authentication material other than password (whose support\n     was added recently), which has been corrected.\n   * Fix for an embarrassing typo that prevented Python2 tests from running\n     anywhere.\n   * Varargs functions that are unannotated as printf-like or execl-like\n     have been annotated as such.\n   * \"git am\" has a safety feature to prevent it from starting a new\n     session when there already is a session going.  It reliably\n     triggers when a mbox is given on the command line, but it has to\n     rely on the tty-ness of the standard input.  Add an explicit way to\n     opt out of this safety with a command line option.\n     (merge 62c71ace44 jk/am-retry later to maint).\n   * A leak in \"git imap-send\" that somehow escapes LSan has been\n     plugged.\n   * Setting core.abbrev too early before the repository set-up\n     (typically in \"git clone\") caused segfault, which as been\n     corrected.\n   * When the user adds to \"git rebase -i\" instruction to \"pick\" a merge\n     commit, the error experience is not pleasant.  Such an error is now\n     caught earlier in the process that parses the todo list.\n   * We forgot to normalize the result of getcwd() to NFC on macOS where\n     all other paths are normalized, which has been corrected.  This still\n     does not address the case where core.precomposeUnicode configuration\n     is not defined globally.\n   * Earlier we stopped using the tree of HEAD as the default source of\n     attributes in a bare repository, but failed to document it.  This\n     has been corrected.\n   * \"git update-server-info\" and \"git commit-graph --write\" have been\n     updated to use the tempfile API to avoid leaving cruft after\n     failing.\n   * An unused extern declaration for mingw has been removed to prevent\n     it from causing build failure.\n   * A helper function shared between two tests had a copy-paste bug,\n     which has been corrected.\n   * \"git fetch-pack -k -k\" without passing \"--lock-pack\" (which we\n     never do ourselves) did not work at all, which has been corrected.\n   * CI job to build minimum fuzzers learned to pass NO_CURL=NoThanks to\n     the build procedure, as its build environment does not offer, or\n     the rest of the build needs, anything cURL.\n     (merge 4e66b5a990 jc/fuzz-sans-curl later to maint).\n   * \"git diff --no-ext-diff\" when diff.external is configured ignored\n     the \"--color-moved\" option.\n     (merge 0f4b0d4cf0 rs/diff-color-moved-w-no-ext-diff-fix later to maint).\n   * \"git archive --add-virtual-file=\u003cpath\u003e:\u003ccontents\u003e\" never paid\n     attention to the --prefix=\u003cprefix\u003e option but the documentation\n     said it would. The documentation has been corrected.\n     (merge 72c282098d jc/archive-prefix-with-add-virtual-file later to maint).\n   * When GIT_PAGER failed to spawn, depending on the code path taken,\n     we failed immediately (correct) or just spew the payload to the\n     standard output (incorrect).  The code now always fail immediately\n     when GIT_PAGER fails.\n     (merge 78f0a5d187 rj/pager-die-upon-exec-failure later to maint).\n   * date parser updates to be more careful about underflowing epoch\n     based timestamp.\n     (merge 9d69789770 db/date-underflow-fix later to maint).\n   * The Bloom filter used for path limited history traversal was broken\n     on systems whose \"char\" is unsigned; update the implementation and\n     bump the format version to 2.\n     (merge 9c8a9ec787 tb/path-filter-fix later to maint).\n   * Typofix.\n     (merge 231cf7370e as/pathspec-h-typofix later to maint).\n   * Code clean-up.\n     (merge 4b837f821e rs/simplify-submodule-helper-super-prefix-invocation later to maint).\n   * \"git describe --dirty --broken\" forgot to refresh the index before\n     seeing if there is any chang, (\"git describe --dirty\" correctly did\n     so), which has been corrected.\n     (merge b8ae42e292 as/describe-broken-refresh-index-fix later to maint).\n   * Test suite has been taught not to unnecessarily rely on DNS failing\n     a bogus external name.\n     (merge 407cdbd271 jk/tests-without-dns later to maint).\n   * GitWeb update to use committer date consistently in rss/atom feeds.\n     (merge cf6ead095b am/gitweb-feed-use-committer-date later to maint).\n   * Custom control structures we invented more recently have been\n     taught to the clang-format file.\n     (merge 1457dff9be rs/clang-format-updates later to maint).\n   * Developer build procedure fix.\n     (merge df32729866 tb/dev-build-pedantic-fix later to maint).\n   * \"git push\" that pushes only deletion gave an unnecessary and\n     harmless error message when push negotiation is configured, which\n     has been corrected.\n     (merge 4d8ee0317f jc/disable-push-nego-for-deletion later to maint).\n   * Address-looking strings found on the trailer are now placed on the\n     Cc: list after running through sanitize_address by \"git send-email\".\n     (merge c852531f45 cb/send-email-sanitize-trailer-addresses later to maint).\n   * Tests that use GIT_TEST_SANITIZE_LEAK_LOG feature got their exit\n     status inverted, which has been corrected.\n     (merge 8c1d6691bc rj/test-sanitize-leak-log-fix later to maint).\n   * The http.cookieFile and http.saveCookies configuration variables\n     have a few values that need to be avoided, which are now ignored\n     with warning messages.\n     (merge 4f5822076f jc/http-cookiefile later to maint).\n   * Repacking a repository with multi-pack index started making stupid\n     pack selections in Git 2.45, which has been corrected.\n     (merge 8fb6d11fad ds/midx-write-repack-fix later to maint).\n   * Fix documentation mark-up regression in 2.45.\n     (merge 6474da0aa4 ja/doc-markup-updates-fix later to maint).\n   * Work around asciidoctor's css that renders `monospace` material\n     in the SYNOPSIS section of manual pages as block elements.\n     (merge d44ce6ddd5 js/doc-markup-updates-fix later to maint).\n\n- CVE-2024-24577: Fixed arbitrary code execution due to heap corruption\n  in git_index_add (bsc#1219660)\n\n- Update to 2.45.2:\n  \n  * Revert \"defense in depth\" fixes from 2.45.1 broke 'git lfs' and\n   'git annex'\n\n- remove dependency on /usr/bin/python3 using\n  %python3_fix_shebang_path macro, [bsc#1212476]\n","status":"published","published":"2025-09-22T09:07:57Z","modified":"2026-03-23T04:50:15.418065Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20855-1","title":"Security update for git","description":"This update for git fixes the following issues:\n\nUpdate to 2.51.0:\n\n- CVE-2025-27613: arbitrary writable file creation and truncation in Gitk (bsc#1245938)\n- CVE-2025-27614: arbitrary script execution via repo clonation in gitk (bsc#1245939)\n- CVE-2025-46835: untrusted repository cloning can lead to arbitrary writable file creation in Git GUI (bsc#1245942)\n- CVE-2025-48384: script may be unintentionally executed after checkout due to CRLF transforming (bsc#1245943)\n- CVE-2025-48385: arbitrary code execution due to protocol injection via fetching advertised bundle (bsc#1245946)\n- CVE-2025-48386: buffer overflow in static buffer 'target' in wincred credential helper (bsc#1245947)\n","status":"published","published":"2025-10-09T14:25:15Z","modified":"2026-03-23T04:49:07.337103Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-7626-1","title":"git vulnerabilities","description":"Avi Halachmi discovered that Git incorrectly managed file modification\nconstraints with Gitk. An attacker could possibly use this issue to create\nor write to arbitrary files on the system. (CVE-2025-27613)\n\nAvi Halachmi discovered that Git incorrectly handled arguments when\ninvoking the Gitk utility. If a user were tricked into cloning a malicious\nGit repository, an attacker could possibly use this issue to run arbitrary\ncommands. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and\nUbuntu 25.04. (CVE-2025-27614)\n\nJohannes Sixt discovered that Git incorrectly managed file modification\nconstraints with Git GUI. If a user were tricked into editing a file in a\nmalicious Git repository, an attacker could possibly use this issue to\ncreate or write to arbitrary files on the system. (CVE-2025-46835)\n\nDavid Leadbeater discovered that Git incorrectly stripped CRLF characters\nwhen editing configuration files. An attacker could possibly use this issue\nto execute arbitrary code. (CVE-2025-48384)\n\nDavid Leadbeater discovered that Git incorrectly handled verification when\nfetching remote Git repositories. An attacker could possibly use this issue\nto perform protocol injection, leading to arbitrary code execution. This\nissue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.\n(CVE-2025-48385)\n\nDavid Leadbeater discovered that Git incorrectly handled memory with the\nwincred credential helper. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2025-48386)","status":"published","published":"2025-07-08T17:57:32Z","modified":"2026-06-25T13:32:30.620229702Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}