{"id":"CVE-2026-114469","kind":"vulnerability","aliases":["CVE-2026-114469"],"related":[],"title":"Git: git-apply can crash on oversized binary patches","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size","summary":"A bug in git-apply lets a crafted binary patch that inflates to a very large size trigger an out-of-bounds read. The result is a crash of the git-apply command.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"git","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["git","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:07+00:00","updated_at":"2026-11-12T14:39:07+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-12T14:39:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Git: git-apply can crash on oversized binary patches","impact":"low","summary":"A bug in git-apply lets a crafted binary patch that inflates to a very large size trigger an out-of-bounds read. The result is a crash of the git-apply command.","audience":"developers","category":"other","nicknames":[],"who_cares":["git"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"git-apply crashes when applying a crafted patch","analyst_note":"Check the NVD entry and the Git project's announcements for affected versions, fixed versions and whether the crash is only a denial of service.","how_to_check":"unknown","plain_action":"","product_name":"git","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":4478,"output_tokens":345,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114469':13A,16A '-2026':12A,15A '1':65C 'appli':4A,24B,53B,64C 'binari':9A,28B,67C 'bound':42B,58C 'bug':20B 'command':54B 'craft':27B 'crash':6A,48B,61C 'cve':11A,14A 'git':1A,3A,17A,18B,23B,52B,63C 'git-appli':2A,22B,51B,62C 'inflat':31B,69C 'larg':35B,72C 'let':25B 'out-of-bound':39B,55C 'overs':8A 'patch':10A,29B,68C 'read':43B,59C 'result':45B 'size':36B,73C 'trigger':37B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["git"],"ptokens":["git"],"labels":["git","medium","other","vendor"],"campaign_type":null,"search_a":"'-114469':13A,16A '-2026':12A,15A 'appli':4A 'binari':9A 'crash':6A 'cve':11A,14A 'git':1A,3A,17A 'git-appli':2A 'overs':8A 'patch':10A","search_b":"'appli':24B,53B 'binari':28B 'bound':42B 'bug':20B 'command':54B 'craft':27B 'crash':48B 'git':18B,23B,52B 'git-appli':22B,51B 'inflat':31B 'larg':35B 'let':25B 'out-of-bound':39B 'patch':29B 'read':43B 'result':45B 'size':36B 'trigger':37B","search_c":"'1':65C 'appli':64C 'binari':67C 'bound':58C 'crash':61C 'git':63C 'git-appli':62C 'inflat':69C 'larg':72C 'out-of-bound':55C 'patch':68C 'read':59C 'size':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cvss_by":"cve@gitlab.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","severity":null,"published_at":"2026-11-12T14:17:23+00:00","modified_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}