Description
Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| git | git | < 2.17.4, >= 2.18.0, < 2.18.3, >= 2.19.0, 2.19.4, >= 2.20.0, < 2.20.3, >= 2.21.0, < 2.21.2, >= 2.22.0, < 2.22.3, >= 2.23.0, < 2.23.2, >= 2.24.0, < 2.24.2, >= 2.25.0, < 2.25.3, >= 2.26.0, < 2.26.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | git | 1:2.26.1-1 | — |
| Debian 13 | git | 1:2.26.1-1 | — |
| Debian 12 | git | 1:2.26.1-1 | — |
| Debian 10 | git | 1:2.20.1-2+deb10u2 | DSA-4657-1 |
| Debian 9 | git | 1:2.11.0-3+deb9u6 | DSA-4657-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | git | 1:2.1.4-2.1+deb8u9 | DLA-2177-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | git | 1:2.17.1-1ubuntu0.6 | USN-4329-1 |
| Ubuntu 16.04 LTS | git | 1:2.7.4-0ubuntu1.8 | USN-4329-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | git +13 | 2.18.2-2.el8_1 | RHSA-2020:1513 |
| RHEL 7 | git +17 | 1.8.3.1-22.el7_8 | RHSA-2020:1511 |
| RHEL 3 | rh-git218-git +15 | 2.18.2-3.el7 | RHSA-2020:1503 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.0 E4S | git +13 | 2.18.2-2.el8_0 | RHSA-2020:1518 |
| RHEL 7.7 EUS | git +17 | 1.8.3.1-23.el7_7 | RHSA-2020:3581 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | git | 2.16.4-3.20.1 | SUSE-SU-2020:1121-1, SUSE-SU-2020:0991-1 |
| SLES 15 | git | 2.16.4-3.20.1 | SUSE-SU-2020:0991-1 |
| SLES 12 SP5 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES 12 SP5 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP5 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP4 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES 12 SP4 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP4 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP3 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES 12 SP3 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP3 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES 12 SP2 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP2 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP1 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES 12 SP1 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES 12 SP1 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 15 | git | 2.16.4-3.20.1 | SUSE-SU-2020:0991-1 |
| SLES for SAP 12 SP5 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP5 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP5 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP4 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP4 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP4 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP3 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP3 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP3 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP2 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP2 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP2 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP1 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP1 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SLES for SAP 12 SP1 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SLE HPC 15 | git | 2.16.4-3.20.1 | SUSE-SU-2020:0991-1 |
| SUSE OpenStack Cloud Crowbar 8 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud Crowbar 8 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud Crowbar 8 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud 8 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud 8 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud 8 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud 7 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud 7 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE OpenStack Cloud 7 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE HPE Helion OpenStack 8 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SUSE HPE Helion OpenStack 8 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE HPE Helion OpenStack 8 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE Enterprise Storage 5 | git | 2.26.0-27.27.1 | SUSE-SU-2020:1295-1, SUSE-SU-2020:0992-1 |
| SUSE Enterprise Storage 5 | pcre2 | 10.34-1.3.1 | SUSE-SU-2020:0992-1 |
| SUSE Enterprise Storage 5 | perl-CGI | 4.38-1.3.1 | SUSE-SU-2020:0992-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.33.0-1.3 | openSUSE-SU-2024:10786-1 |
| openSUSE Leap 15.1 | git | 2.16.4-lp151.4.6.1 | openSUSE-SU-2020:0598-1, openSUSE-SU-2020:0524-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | git | 2.26.1-r0 | — |
| Alpine v3.23 | git | 2.26.1-r0 | — |
| Alpine v3.22 | git | 2.26.1-r0 | — |
| Alpine v3.21 | git | 2.26.1-r0 | — |
| Alpine v3.20 | git | 2.26.1-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | git | 2.26.1-r0 | — |
| Alpine v3.18 | git | 2.26.1-r0 | — |
| Alpine v3.17 | git | 2.26.1-r0 | — |
| Alpine v3.16 | git | 2.26.1-r0 | — |
| Alpine v3.15 | git | 2.26.1-r0 | — |
| Alpine v3.14 | git | 2.26.1-r0 | — |
| Alpine v3.13 | git | 2.26.1-r0 | — |
| Alpine v3.12 | git | 2.26.1-r0 | — |
| Alpine v3.11 | git | 2.24.2-r0 | — |
| Alpine v3.10 | git | 2.22.3-r0 | — |
| Alpine v3.9 | git | 2.20.3-r0 | — |
| Alpine v3.8 | git | 2.18.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | git +15 | 2.23.1-1.amzn2.0.2 | ALAS2-2020-1409 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | git +13 | 2.18.2-2.el8_1 | ELSA-2020-1513 |
| Oracle Linux 7 | git +17 | 1.8.3.1-22.el7_8 | ELSA-2020-1511 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 3 repositories
-
brompwnie/cve-2020-5260 ★ 37 · Apr 15, 2020
A HTTP PoC Endpoint for cve-2020-5260 which can be deployed to Heroku
-
sv3nbeast/CVE-2020-5260 ★ 11 · Apr 16, 2020
CVE-2020-5260演示记录
-
Asgavar/CVE-2020-5260 ★ 0 · Apr 15, 2020
https://bugs.chromium.org/p/project-zero/issues/detail?id=2021
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 20
- RHSA-2020:3581 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:1518 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:1513 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:1511 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:1503 Red Hat Security Advisory: rh-git218-git security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4657-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2177-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-1905 IBM QRadar SIEM Komponente: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 4, 2026
- USN-4329-1 git vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2020:0598-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0524-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1295-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10786-1 git-2.33.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1121-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0991-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0189 git: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 21, 2025
- SUSE-SU-2020:0992-1 Security update for git SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2020-1511 Important: git security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 22, 2020
- ELSA-2020-1513 Important: git security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 21, 2020
- ALAS2-2020-1409 Important: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 15, 2020
References
- https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q
- https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b
- https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/
- DSA-4657 vendor-advisory
- [debian-lts-announce] 20200415 [SECURITY] [DLA 2177-1] git security update mailing-list
- [oss-security] 20200415 CVE-2020-5260: Git: malicious URLs may cause Git to present stored credentials to the wrong server mailing-list
- http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html
- [oss-security] 20200415 Re: CVE-2020-5260: Git: malicious URLs may cause Git to present stored credentials to the wrong server mailing-list
- openSUSE-SU-2020:0524 vendor-advisory
- https://support.apple.com/kb/HT211141
- FEDORA-2020-cdef88bb89 vendor-advisory
- [oss-security] 20200420 CVE-2020-11008: Git: Malicious URLs can still cause Git to send a stored credential to the wrong server mailing-list
- GLSA-202004-13 vendor-advisory
- FEDORA-2020-c6548b488f vendor-advisory
- FEDORA-2020-f6b3b6fb18 vendor-advisory
- FEDORA-2020-b2a2c830cf vendor-advisory
- USN-4329-1 vendor-advisory
- FEDORA-2020-4e093619bb vendor-advisory
- openSUSE-SU-2020:0598 vendor-advisory