{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/github-enterprise-server-3.19-3.22/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-105437"},{"id":"CVE-2026-111760"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Enterprise Server (3.19.0 \u003c 3.19.14)","Enterprise Server (3.20.0 \u003c 3.20.10)","Enterprise Server (3.21.0 \u003c 3.21.8)","Enterprise Server (3.22.0 \u003c 3.22.3)","Git (2.50-2.56)","GitHub Enterprise Server (3.19-3.22)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","enterprise-server","security-update"],"_cs_type":"advisory","_cs_vendors":["GitHub","Git"],"content_html":"\u003cp\u003eThe Git project has released updates addressing six security vulnerabilities affecting Git versions 2.50 through 2.55 and 2.56. The most critical issue, CVE-2026-111760, involves integer truncation during index handling, which can allow an attacker to write files outside of the intended directory structure and execute arbitrary code via malicious Git hooks. Other vulnerabilities include path traversal during clones, memory corruption during tag merges, and integer overflows leading to crashes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities can lead to remote code execution (RCE) on developer workstations or build servers that process malicious repositories, as well as denial of service (DoS) conditions for Git hosting infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all Git installations to the patched versions: 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, or 2.56.1.\u003c/li\u003e\n\u003cli\u003eUpgrade GitHub Enterprise Server to version 3.19.15, 3.20.11, 3.21.9, or 3.22.4.\u003c/li\u003e\n\u003cli\u003eImplement temporary mitigations for CVE-2026-105437 by adding \u003ccode\u003econflict-marker-size=7\u003c/code\u003e to repository \u003ccode\u003einfo/attributes\u003c/code\u003e files or disabling automated merge checks for untrusted repositories.\u003c/li\u003e\n\u003cli\u003eEnforce strict policies against recursive cloning and processing of untrusted repositories, patches, or fast-import streams.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T20:01:47Z","date_published":"2026-11-04T21:09:06Z","id":"https://feed.craftedsignal.io/briefs/2026-11-github-enterprise-updates/","summary":"Multiple vulnerabilities in Git, including an integer truncation flaw (CVE-2026-111760), enable attackers to achieve remote code execution or denial of service via malicious repositories during recursive clones or merge operations.","title":"Git: Multiple vulnerabilities allowing remote code execution and denial of service","url":"https://feed.craftedsignal.io/briefs/2026-11-github-enterprise-updates/"}],"language":"en","title":"CraftedSignal Threat Feed - GitHub Enterprise Server (3.19-3.22)","version":"https://jsonfeed.org/version/1.1"}