git-for-windows/git v2.54.0.windows.3

MinGit for Windows 2.54.0(3)

on GitHub

Changes since Git for Windows v2.54.0(2) (July 14th 2026)

This is a security fix release, addressing CVE-2026-62960.

• CVE-2026-62960, Git for Windows: Attacker-controlled servers may advertise bundle URIs that point to network shares, causing Windows to transparently perform NTLM authentication and disclose the user's NTLMv2 hash. Since NTLM hashing is weak, the captured hash can potentially be brute-forced to recover the user's credentials. This is addressed by limiting the bundle URIs that git clone respects by the same protocol.<name>.allow rules as usual, which excludes file:// URIs by default.