Re: Security Vulnerability in Git 2.54.0/OpenSSL 3.5.6 Status

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Jun 29, 2026, 13:57 UTC
Message-ID: <fe8a3a3f-d762-d2c2-9454-a57ac9a75331@gmx.de>
In-Reply-To: <SN4P221MB0713994458A94BFCB51F7AC494EA2@SN4P221MB0713.NAMP221.PROD.OUTLOOK.COM>

Hi Tim,

On Sat, 27 Jun 2026, Person, Tim wrote:

Show 7 quoted lines

> I am writing to determine when Git plans to release an update installer
> to patch the security vulnerability in Git 2.54.0 because of the
> included OpenSSL executable. This vulnerability is rated "Critical" in
> the CVE (https://www.cve.org/CVERecord?id=CVE-2026-34182). An updated
> version of the OpenSSL.exe fixing this problem has been available since
> 06/12/2026. I am just wondering if/when you plan to address this major
> security issue.

OpenSSL.exe is not part of the critical path of Git for Windows. It is merely included as a curiosity for historical reasons. The critical CVE you mentioned does not affect anything in Git itself. Therefore, I did not even consider making an out-of-band release of Git for Windows merely for that OpenSSL v3.5.7 update.

The next Git for Windows release (v2.55.0, likely due later today, may slip to tomorrow) will include OpenSSL v3.5.7.

Ciao, Johannes