GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

A vulnerability in GitHub's commit verification system allows attackers to rewrite signed Git commits into new hashes without breaking their signatures, resulting in multiple valid hashes for the same content. This undermines trust in commit hashes as unique identifiers, enabling potential bypasses of blocklists and provenance systems that rely on them. The issue stems from signature malleability in GPG and S/MIME schemes, which GitHub does not normalize before verification.

AI-extracted · verify before operational use