Re: Security Vulnerability in Git 2.54.0/OpenSSL 3.5.6 Status

Hi Tim,

On Sat, 27 Jun 2026, Person, Tim wrote:

I am writing to determine when Git plans to release an update installer
to patch the security vulnerability in Git 2.54.0 because of the
included OpenSSL executable. This vulnerability is rated "Critical" in
the CVE (https://www.cve.org/CVERecord?id=CVE-2026-34182). An updated
version of the OpenSSL.exe fixing this problem has been available since
06/12/2026. I am just wondering if/when you plan to address this major
security issue.

OpenSSL.exe is not part of the critical path of Git for Windows. It is
merely included as a curiosity for historical reasons. The critical CVE
you mentioned does not affect anything in Git itself. Therefore, I did not
even consider making an out-of-band release of Git for Windows merely for
that OpenSSL v3.5.7 update.

The next Git for Windows release (v2.55.0, likely due later today, may
slip to tomorrow) will include OpenSSL v3.5.7.

Ciao,
Johannes