CVE-2026-105437

Name of the Vulnerable Software and Affected Versions Git (affected versions not specified) GitLab versions prior to 19.5.4

Description A heap buffer overflow exists in the three-way merge code (xdiff). This occurs because the total size of the merged output is stored in a 32-bit signed integer. An attacker can use a .gitattributes file to set a large conflict-marker-size attribute. When combined with multiple conflicts, the total size can exceed 4 GiB, causing the integer to wrap to a small value. This leads to the application writing attacker-controlled merge output beyond the allocated buffer, which can result in a crash or heap corruption. This issue can be triggered by commands that perform textual three-way merges, such as git-merge(), git-rebase(), git-cherry-pick(), and git-merge-tree(). In server-side environments, an attacker can trigger this by pushing branches and requesting merges.

Recommendations Update GitLab to version 19.5.4. As a temporary workaround for servers, add conflict-marker-size=7 to the info/attributes file of each repository to override in-tree .gitattributes. Disable server-side mergeability checks for untrusted repositories.