Moderate Security Update for Git LFS: Addressing Request Smuggling Vulnerability
Summary
ALSA-2025:9060: Moderate: git-lfs security update. Affects git-lfs versions < 3.4.1-5.el8_10. Fixed in 3.4.1-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files efficiently. It replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the actual file contents on a remote server. This functionality is crucial for developers who work with large assets, ensuring that repositories remain lightweight and manageable. However, vulnerabilities in Git LFS can expose users to security risks, such as the recent request smuggling issue.
Vulnerability Detail
The vulnerability identified as CVE-2025-22871 arises from the acceptance of invalid chunked data in the net/http package. This flaw can lead to request smuggling attacks, where an attacker can manipulate the way requests are processed, potentially allowing unauthorized access or data leakage. The implications of this vulnerability are significant, as it can compromise the integrity and confidentiality of the data being handled by applications using Git LFS.
How To Fix
Minimum fixed version
3.4.1-5.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of Git LFS until the update is applied. It is advisable to monitor the application's behavior and limit the use of large file operations until the patch is implemented.
Conclusion
The moderate security update for Git LFS addresses a critical vulnerability that could lead to request smuggling attacks. Users are encouraged to update to the latest version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring that applications remain secure.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with pointers in the repository while storing the actual files on a remote server.
CVE-2025-22871 is a security vulnerability in Git LFS that allows for request smuggling due to the acceptance of invalid chunked data in the net/http package.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The risks include unauthorized access to sensitive data, data leakage, and potential manipulation of requests, which can compromise application integrity.
You can update Git LFS by running the command 'sudo dnf update git-lfs' in your terminal, ensuring you have access to the correct repositories.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
