{"id":"CVE-2026-105437","kind":"vulnerability","aliases":["CVE-2026-105437"],"related":[],"title":"Git: oversized merge markers overflow a heap buffer during three-way merges","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories.","summary":"A crafted repository with a huge conflict-marker-size attribute makes Git's merge code compute a wrapped size and write past a buffer that is too small. The result is a crash of Git and possible heap corruption that an attacker can shape.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","git","git-forges","package","self-hosted"],"not_affected_if":["no-server-side-merge","trusted-repos-only"],"how_to_check":"- Run `git --version` and compare against the fixed versions below.\n- On servers that run merges (git-merge-tree, forge mergeability checks), look for `attr.tree` or `--attr-source` in configuration or scripts.\n- Check whether the server reads `.gitattributes` from repository trees.","fix":null,"status":"open","published_at":"2026-11-10T19:17:46+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","triaged_at":"2026-11-10T19:47:34+00:00","updated_at":"2026-11-10T19:47:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T19:47:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Git: oversized merge markers overflow a heap buffer during three-way merges","impact":"high","summary":"A crafted repository with a huge conflict-marker-size attribute makes Git's merge code compute a wrapped size and write past a buffer that is too small. The result is a crash of Git and possible heap corruption that an attacker can shape.","audience":"developers","category":"package","nicknames":[],"who_cares":["git","git-forges","self-hosted","ci"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Git crashes, and attacker-shaped data may corrupt heap memory on the server","analyst_note":"Confirm the patched Git versions from the official Git release notes or NVD configuration, since the sources here give no fixed version.","how_to_check":"- Run `git --version` and compare against the fixed versions below.\n- On servers that run merges (git-merge-tree, forge mergeability checks), look for `attr.tree` or `--attr-source` in configuration or scripts.\n- Check whether the server reads `.gitattributes` from repository trees.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-server-side-merge","trusted-repos-only"],"who_is_affected":"Any command that performs a textual three-way merge can trigger it, including merge, rebase, cherry-pick and git-merge-tree. Git forges that run server-side mergeability checks with attributes read from trees are the most exposed, because any user who can push a branch and open a merge request can trigger it. Local use on repositories you trust is lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000805,"input_tokens":5079,"output_tokens":594,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm the patched Git versions from the official Git release notes or NVD configuration, since the sources here give no fixed version.","search":"'-105437':16A,19A '-2026':15A,18A '1':256C,260C,265C,271C,289C '32':135C '4':186C '7':401C 'accept':154C 'add':108C,396C 'addit':377C 'affect':74C 'alloc':116C 'anyon':342C 'anyth':345C 'appear':358C 'attack':71B,93C,200C,231C 'attacker-control':199C,230C 'attr':314C 'attr-sourc':313C 'attr.tree':311C 'attribut':39B,144C,302C 'away':394C 'bit':136C 'branch':321C 'buffer':8A,53B,81C,118C,209C 'cannot':391C 'check':296C,375C,424C 'cherri':263C 'ci':20B 'code':44B,89C 'command':239C 'commit':151C 'comput':45B,368C 'conflict':36B,141C,167C,179C,398C 'conflict-marker-s':35B,140C,397C 'content':227C 'control':100C,201C,232C 'corrupt':68B,235C 'craft':30B 'crash':62B,217C 'cve':14A,17A 'data':348C 'els':343C 'end':206C 'error':385C 'everi':166C,376C 'exampl':309C,329C 'file':105C,153C,170C 'first':107C 'forg':24B,281C 'gib':187C 'git':1A,21B,23B,41B,64B,77C,102C,197C,218C,254C,258C,262C,268C,280C,286C,381C 'git-cherry-pick':261C 'git-forg':22B 'git-merg':253C 'git-merge-tre':267C,285C 'git-rebas':257C 'gitattribut':152C,416C 'heap':7A,67B,80C,234C 'host':28B 'huge':34B,173C 'in-tre':413C 'info/attributes':406C 'instead':386C 'integ':138C,157C,190C 'kept':132C 'larg':224C,229C 'latter':273C 'like':276C 'make':40B 'mani':177C 'marker':4A,37B,142C,160C,174C,399C 'merg':3A,13A,43B,88C,103C,114C,202C,247C,255C,269C,287C,327C,335C,361C 'mergeabl':297C,423C 'might':283C 'minimum':215C 'open':331C 'output':115C,126C,203C,356C 'overflow':5A,82C,222C,340C,379C,388C 'overrid':411C 'overs':2A,355C 'packag':25B 'past':51B,185C,204C 'patch':366C 'pick':264C 'posit':156C 'possibl':66B,237C 'problem':363C 'pull':333C 'push':182C,320C,350C 'read':301C 'rebas':259C 'repositori':31B,98C,307C,404C,427C 'request':323C,336C 'result':59B 'right':393C 'self':27B 'self-host':26B 'separ':178C 'server':293C,300C,389C,421C 'server-sid':292C,420C 'set':148C 'sever':163C 'shape':73B 'side':294C,422C 'sign':137C 'size':38B,48B,111C,121C,143C,175C,370C,372C,400C 'small':57B,169C,194C,213C,352C 'sourc':315C 'stop':382C 'target':278C 'textual':243C 'therefor':181C 'three':11A,86C,245C 'three-way':10A,85C,244C 'time':164C 'total':130C,184C 'tree':270C,288C,304C,415C 'trigger':95C,249C,338C 'turn':418C 'untrust':426C 'upgrad':392C 'use':284C 'user':317C 'valu':195C 'version':75C 'way':12A,87C,246C 'without':341C 'workaround':409C 'wors':233C 'wrap':47B,191C 'write':50B,124C,198C 'written':162C 'xdiff':90C","nicknames":[],"mitigations":[],"who_affected":"Any command that performs a textual three-way merge can trigger it, including merge, rebase, cherry-pick and git-merge-tree. Git forges that run server-side mergeability checks with attributes read from trees are the most exposed, because any user who can push a branch and open a merge request can trigger it. Local use on repositories you trust is lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","git","gitforges","high","package","selfhosted"],"campaign_type":null,"search_a":"'-105437':16A,19A '-2026':15A,18A 'buffer':8A 'cve':14A,17A 'git':1A 'heap':7A 'marker':4A 'merg':3A,13A 'overflow':5A 'overs':2A 'three':11A 'three-way':10A 'way':12A","search_b":"'attack':71B 'attribut':39B 'buffer':53B 'ci':20B 'code':44B 'comput':45B 'conflict':36B 'conflict-marker-s':35B 'corrupt':68B 'craft':30B 'crash':62B 'forg':24B 'git':21B,23B,41B,64B 'git-forg':22B 'heap':67B 'host':28B 'huge':34B 'make':40B 'marker':37B 'merg':43B 'packag':25B 'past':51B 'possibl':66B 'repositori':31B 'result':59B 'self':27B 'self-host':26B 'shape':73B 'size':38B,48B 'small':57B 'wrap':47B 'write':50B","search_c":"'1':256C,260C,265C,271C,289C '32':135C '4':186C '7':401C 'accept':154C 'add':108C,396C 'addit':377C 'affect':74C 'alloc':116C 'anyon':342C 'anyth':345C 'appear':358C 'attack':93C,200C,231C 'attacker-control':199C,230C 'attr':314C 'attr-sourc':313C 'attr.tree':311C 'attribut':144C,302C 'away':394C 'bit':136C 'branch':321C 'buffer':81C,118C,209C 'cannot':391C 'check':296C,375C,424C 'cherri':263C 'code':89C 'command':239C 'commit':151C 'comput':368C 'conflict':141C,167C,179C,398C 'conflict-marker-s':140C,397C 'content':227C 'control':100C,201C,232C 'corrupt':235C 'crash':217C 'data':348C 'els':343C 'end':206C 'error':385C 'everi':166C,376C 'exampl':309C,329C 'file':105C,153C,170C 'first':107C 'forg':281C 'gib':187C 'git':77C,102C,197C,218C,254C,258C,262C,268C,280C,286C,381C 'git-cherry-pick':261C 'git-merg':253C 'git-merge-tre':267C,285C 'git-rebas':257C 'gitattribut':152C,416C 'heap':80C,234C 'huge':173C 'in-tre':413C 'info/attributes':406C 'instead':386C 'integ':138C,157C,190C 'kept':132C 'larg':224C,229C 'latter':273C 'like':276C 'mani':177C 'marker':142C,160C,174C,399C 'merg':88C,103C,114C,202C,247C,255C,269C,287C,327C,335C,361C 'mergeabl':297C,423C 'might':283C 'minimum':215C 'open':331C 'output':115C,126C,203C,356C 'overflow':82C,222C,340C,379C,388C 'overrid':411C 'overs':355C 'past':185C,204C 'patch':366C 'pick':264C 'posit':156C 'possibl':237C 'problem':363C 'pull':333C 'push':182C,320C,350C 'read':301C 'rebas':259C 'repositori':98C,307C,404C,427C 'request':323C,336C 'right':393C 'separ':178C 'server':293C,300C,389C,421C 'server-sid':292C,420C 'set':148C 'sever':163C 'side':294C,422C 'sign':137C 'size':111C,121C,143C,175C,370C,372C,400C 'small':169C,194C,213C,352C 'sourc':315C 'stop':382C 'target':278C 'textual':243C 'therefor':181C 'three':86C,245C 'three-way':85C,244C 'time':164C 'total':130C,184C 'tree':270C,288C,304C,415C 'trigger':95C,249C,338C 'turn':418C 'untrust':426C 'upgrad':392C 'use':284C 'user':317C 'valu':195C 'version':75C 'way':87C,246C 'without':341C 'workaround':409C 'wors':233C 'wrap':191C 'write':124C,198C 'written':162C 'xdiff':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","severity":null,"published_at":"2026-11-10T19:17:46+00:00","modified_at":"2026-11-10T19:17:46+00:00","first_seen_at":"2026-11-10T19:24:14+00:00","fetched_at":"2026-11-10T19:24:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}