AES-GCM will be insecure if the attacker is allowed to perform
entangled queries on your GCM implementation
However, it's been stated several times that this is an unrealistic scenario. I don't know enough on the topic to comment, but poncho and Squeamish Ossifrage know what they're talking about.
will HMAC-256 with 256 bit tag used along with AES256-GCM protect
against such a situation?
The attack should be infeasible due to the longer tag.
Also AES-GCM is non key committing .will adding HMAC-256 protect it
instead of using AES256-CBC or AES-CTR with HMAC-256?
AES-GCM-then-HMAC will be key- and message-committing if you derive the keys properly and use a 256-bit+ tag.
However, there's no point doing this because of the overhead of performing authentication twice and storing two tags. You'd be better off just doing AES-CTR-then-HMAC or (X)ChaCha20-then-BLAKE2b/BLAKE3. For misuse resistance, you can do XChaCha20-SIV.
AES-GCM alone is neither key- nor message-committing because of the 128-bit tag. Modifications to the design of AES-GCM can make it key-committing, but it won't be as strong as HMAC still, and you need to combine it with a hash function to make it message-committing.
AEADs should really have 256-bit tags, but that unfortunately hasn't happened and probably won't happen for quite some time. For instance, all the final portfolio AEADs from the CAESAR competition have 128-bit tags as far as I know. AEGIS-256 has a 256-bit key and opted for a 256-bit nonce but not a 256-bit tag.