Critical Security Update for Git LFS: Addressing Memory Exhaustion and TLS Resumption Issues
Summary
ALSA-2026:3985: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-8.el8_10. Fixed in 3.4.1-8.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, as it optimizes repository size and improves performance. However, recent vulnerabilities have been identified that could compromise the security of Git LFS.
Vulnerability Detail
The vulnerabilities in Git LFS stem from issues in the underlying Go libraries it utilizes. Specifically, CVE-2025-61726 highlights a memory exhaustion vulnerability in the net/url package, which can lead to denial of service if an attacker sends specially crafted query parameters. Additionally, CVE-2025-68121 addresses an unexpected session resumption issue in the crypto/tls package, which could allow an attacker to exploit session management flaws. These vulnerabilities pose significant risks, including potential service outages and unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.4.1-8.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for these vulnerabilities. The best course of action is to apply the available patch as soon as possible.
Conclusion
In summary, Git LFS has critical vulnerabilities that need immediate attention. Users are advised to update to the latest patched version to protect against potential security threats. Regular monitoring and updates are essential to maintain the integrity and security of software applications.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers in the repository while storing the actual files on a remote server.
The vulnerabilities include a memory exhaustion issue in the net/url package and an unexpected session resumption issue in the crypto/tls package.
You can update Git LFS by running the command 'sudo dnf update git-lfs' in your terminal to install the patched version.
The vulnerabilities could lead to denial of service attacks and unauthorized access to sensitive data, posing significant security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.