Moderate Security Update for Git LFS: Addressing CVE-2025-22871
Summary
ALSA-2025:9106: Moderate: git-lfs security update. Affects git-lfs versions < 3.6.1-2.el9_6. Fixed in 3.6.1-2.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, as it helps keep repositories lightweight and manageable. However, a security vulnerability has been identified in Git LFS that could potentially compromise the integrity of data transfers.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22871, arises from a request smuggling issue in the net/http module due to the acceptance of invalid chunked data. This flaw can allow an attacker to manipulate HTTP requests, potentially leading to unauthorized access or data corruption. The ramifications of this vulnerability could be severe, especially in environments where sensitive data is transmitted, making it imperative for users to address this issue promptly.
How To Fix
Minimum fixed version
3.6.1-2.el9_6
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of Git LFS for sensitive operations until the package is updated. Additionally, monitoring network traffic for unusual patterns may help mitigate risks until the fix is applied.
Conclusion
The identified vulnerability in Git LFS, CVE-2025-22871, poses a moderate risk that can lead to serious security issues if not addressed. Users are strongly encouraged to update to the latest patched version to safeguard their applications and data.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers and storing the actual files on a remote server.
CVE-2025-22871 is a security vulnerability in Git LFS that involves request smuggling due to the acceptance of invalid chunked data, potentially leading to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Git LFS right away, consider limiting its use for sensitive operations and monitor network traffic for any unusual activity.
For more details about CVE-2025-22871, including its impact and technical specifics, refer to the official CVE page linked in the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
