Critical Security Update for Git: Addressing Multiple Vulnerabilities
Summary
DLA-4323-1: git - security update. Affects git versions < 1:2.30.2-1+deb11u5. Fixed in 1:2.30.2-1+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git is a widely used version control system that allows developers to track changes in source code during software development. It is known for its speed, data integrity, and support for distributed, non-linear workflows. However, recent vulnerabilities have been identified that could potentially compromise the security of projects relying on Git, necessitating immediate attention from users.
Vulnerability Detail
The vulnerabilities identified in Git, specifically CVE-2025-27613, CVE-2025-46835, and CVE-2025-48384, stem from flaws in the handling of certain operations that could allow an attacker to execute arbitrary code or cause denial of service. These vulnerabilities can be exploited through crafted repositories or malicious commands, posing significant risks to the integrity and availability of software projects.
How To Fix
Minimum fixed version
1:2.30.2-1+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid executing untrusted Git commands or repositories until the update is applied. This includes refraining from cloning or pulling from unknown sources.
Conclusion
In summary, Git users must take immediate action to update their software to the latest version to protect against critical vulnerabilities. By following the provided steps, users can ensure their projects remain secure and resilient against potential attacks.
See every vulnerability recorded for git →
FAQ
The vulnerabilities include CVE-2025-27613, CVE-2025-46835, and CVE-2025-48384, which could lead to arbitrary code execution or denial of service.
You can check your Git version by running 'git --version' in the terminal. If it is older than 1:2.30.2-1+deb11u5, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
As a workaround, avoid executing commands from untrusted sources until you can apply the update.
Detailed information can be found in the Debian security advisory and the CVE entries for each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for git.
