Critical Security Update for Git LFS: Addressing Denial of Service and Memory Exhaustion Vulnerabilities
Summary
RLSA-2026:4164: Important: git-lfs security update. Affects git-lfs versions < 0:3.6.1-7.el10_1. Fixed in 0:3.6.1-7.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with lightweight text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerabilities identified in Git LFS stem from issues in the underlying Go libraries it utilizes. Specifically, CVE-2025-61729 presents a Denial of Service risk due to excessive resource consumption when processing crafted certificates. CVE-2025-61726 highlights a memory exhaustion vulnerability in the query parameter parsing of the net/url package, which could lead to application crashes. Additionally, CVE-2025-68121 involves unexpected session resumption in the crypto/tls package, potentially allowing unauthorized access to sensitive data. These vulnerabilities could severely impact application performance and security, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
0:3.6.1-7.el10_1
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their applications by restricting access to the Git LFS service and monitoring for unusual activity. However, the best course of action is to apply the security update as soon as possible.
Conclusion
The vulnerabilities identified in Git LFS pose significant risks to applications utilizing this package. It is crucial for users to update to the latest patched version to mitigate these risks. By staying informed and utilizing tools like Vulert, developers can better protect their applications from potential threats.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers while storing the actual content on a remote server.
The main vulnerabilities include Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for the vulnerabilities affecting Git LFS is 7.5, indicating a high level of severity.
You can update Git LFS by running the command 'sudo yum update git-lfs' in your terminal to ensure you have the latest security fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
