UBUNTU-CVE-2026-114467: Low severity ubuntu/git vulnerability
Published Nov 13, 2026
·Updated
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
Affected Software
7 affected components
ubuntu/git*
ubuntu/git*
ubuntu/git*
ubuntu/git*
ubuntu/git*
ubuntu/git*
ubuntu/git*
Event History
Nov 13, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What attacker-controlled input is needed to trigger this issue?
An attacker needs to cause git-merge(1) to process a tag containing more than two GPG signatures.
2
Which Git operation is implicated?
The issue is specifically associated with git-merge(1) when it is used on a qualifying multi-signature GPG tag.