Git for Windows 2.55.0(4) fixes NTLM hash leak via bundle URIs

Git for Windows 2.55.0(4) is out as a security release that closes CVE-2026-62960, a flaw in which an attacker-controlled server could advertise bundle URIs pointing at network shares and trick Windows into sending the user's NTLMv2 hash during transparent authentication.

Because NTLM hashes are relatively weak, a captured hash can often be brute-forced offline to recover the underlying credentials. Johannes Schindelin, who announced the build, said the fix limits which bundle URIs git clone will honor, applying the same protocol allow rules used elsewhere so that file:// URIs are excluded by default.

The release also notes that, following MSYS2, Windows 8.1 support will end after the 2.55 line. Users on supported Windows versions should move to 2.55.0(4) promptly.