Critical Security Update for Git LFS: Addressing IPv6 Parsing Vulnerability
Summary
ALSA-2026:7005: Important: git-lfs security update. Affects git-lfs versions < 3.6.1-8.el10_1. Fixed in 3.6.1-8.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, as it optimizes repository size and performance. However, a recent vulnerability has been identified that affects the parsing of IPv6 host literals within the net/url package, which could lead to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 stems from incorrect parsing of IPv6 host literals in the net/url package used by Git LFS. This flaw can potentially allow attackers to exploit the parsing mechanism, leading to unauthorized access or manipulation of data. The ramifications of this vulnerability could include data breaches, loss of integrity of large files, and disruption of services relying on Git LFS for file management. It is crucial for users to address this issue promptly to safeguard their projects and data.
How To Fix
Minimum fixed version
3.6.1-8.el10_1
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using IPv6 host literals in their configurations until the package is updated. This can help reduce the risk of exploitation until a proper fix is applied.
Conclusion
The identified vulnerability in Git LFS poses significant risks due to incorrect parsing of IPv6 host literals. Users are strongly encouraged to update to the patched version to mitigate these risks. Regular updates and monitoring for vulnerabilities are essential practices for maintaining the security of software applications.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers in the repository, while the actual files are stored on a remote server.
CVE-2026-25679 refers to a vulnerability in the net/url package used by Git LFS, which involves incorrect parsing of IPv6 host literals.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include unauthorized access, data breaches, and disruption of services that rely on Git LFS for managing large files.
It is recommended to regularly check for updates and apply them promptly to ensure that any security vulnerabilities are addressed as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
