ALPINE-CVE-2026-114467: Low severity alpine/git vulnerability
Published Nov 12, 2026
·Updated
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
Affected Software
2 affected componentsFixes available
alpine/git<2.52.1-r0
2.52.1-r0
alpine/git<2.54.1-r0
2.54.1-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/gitto a version that resolves this vulnerability.Fixed in 2.52.1-r0 - Upgrade
Upgrade
alpine/gitto a version that resolves this vulnerability.Fixed in 2.54.1-r0
Event History
Nov 12, 2026
CVE Published
via OSV·02:17 PM
Data Sourced
via OSV·02:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access and interaction are required for exploitation?
The vector is local and requires user interaction. No privileges are required according to the supplied severity vector.
2
What is the expected impact if exploitation succeeds?
The reported impact is limited to availability. The severity vector indicates no confidentiality or integrity impact.