---
id: "CVE-2026-105437"
page: "https://infrastack.ai/live/CVE-2026-105437"
kind: "vulnerability"
aliases: ["CVE-2026-105437"]
title: "Git: oversized merge markers overflow a heap buffer during three-way merges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "git", "git-forges", "package", "self-hosted"]
not_affected_if: ["no-server-side-merge", "trusted-repos-only"]
published_at: "2026-11-10T19:17:46+00:00"
first_seen_at: "2026-11-10T19:24:14+00:00"
updated_at: "2026-11-10T19:47:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105437", "first_seen_at": "2026-11-10T19:24:14+00:00"}]
exploit_sources: []
---

# Git: oversized merge markers overflow a heap buffer during three-way merges

Link for people: https://infrastack.ai/live/CVE-2026-105437 (this .md is for agents)

A crafted repository with a huge conflict-marker-size attribute makes Git's merge code compute a wrapped size and write past a buffer that is too small. The result is a crash of Git and possible heap corruption that an attacker can shape.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `git --version` and compare against the fixed versions below.
- On servers that run merges (git-merge-tree, forge mergeability checks), look for `attr.tree` or `--attr-source` in configuration or scripts.
- Check whether the server reads `.gitattributes` from repository trees.

## Timeline

- 2026-11-10T19:24:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105437

## From the sources

Affected versions of Git have a heap buffer overflow in the three-way merge
code (xdiff), which an attacker can trigger through a repository they
control.

When Git merges a file, it first adds up the size of the merged
output, allocates a buffer of that size, and then writes the output into
it. That total was kept in a 32-bit signed integer. The
conflict-marker-size attribute, which can be set from a committed
.gitattributes file, accepts any positive integer, and the markers are
written several times for every conflict. A small file with a huge marker
size and many separate conflicts can therefore push the total past 4 GiB,
so the integer wraps to a small value and Git writes attacker-controlled
merge output past the end of a buffer that is too small. At minimum this
crashes Git, and because the overflow is large and its contents are largely
attacker-controlled, worse heap corruption is possible.

Any command that does a textual three-way merge can trigger it, such
as git-merge(1), git-rebase(1), git-cherry-pick(1), and
git-merge-tree(1). The latter is most likely a target for Git forges,
which might use git-merge-tree(1) on the server-side to check
mergeability. When the server reads attributes from trees in the
repository (for example through attr.tree or --attr-source), any
user who can push branches and request that they be merged (for
example by opening a pull or merge request) can trigger the overflow
without anyone else doing anything, and the data they push is small
because the oversized output only appears during the merge.

The problem has been patched by computing the size as size_t and
checking every addition for overflow, so Git stops with an error
instead of overflowing.

Servers that cannot upgrade right away can add

* conflict-marker-size=7

to each repository's info/attributes as a workaround, which overrides
any in-tree .gitattributes, or turn off server-side mergeability checks for
untrusted repositories.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_