Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-114469: Binary-patch size validation can be bypassed because it checks the encoded input rather than the inflated result, potentially causing an out-of-bounds read and crash. CVE-2026-114467: Removing more than two GPG signatures from commit messages can corrupt stack memory, potentially causing denial of service during merges. CVE-2026-114466: Certain fast-import features can access arbitrary paths and are now disallowed by default. CVE-2026-113408: A server can advertise a malformed unborn HEAD, causing unintended file writes during subsequent ref updates with the files ref backend. CVE-2026-111760: Recursive clones can lead to remote code execution through unsafe handling of submodule-related repository metadata. CVE-2026-105437: Size calculations for very large merge results can overflow, leading to an undersized buffer and heap corruption.
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | git | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-all | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-core | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-core-doc | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-credential-libsecret | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-cvs | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-daemon | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-debuginfo | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-email | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-gui | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-instaweb | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-p4 | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-subtree | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | git-svn | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | gitk | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | gitweb | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | perl-Git | 0:2.47.3-1.amzn2.0.2 |
| Amazon Linux · 2 | perl-Git-SVN | 0:2.47.3-1.amzn2.0.2 |
Vulnerabilities 5
-
High 7.5CVE-2026-105437 Public exploit
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger…
-
Medium 4.4
Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe
-
Medium 4.4
Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size
-
Low 3.3
Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository
-
Low 3.3
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-105437.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-111760.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-113408.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-114466.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-114467.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-114469.html