Critical Security Update for Git LFS: Addressing IPv6 Parsing Vulnerability
Summary
ALSA-2026:7259: Important: git-lfs security update. Affects git-lfs versions < 3.6.1-8.el9_7. Fixed in 3.6.1-8.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics more efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, as it helps to keep the repository lightweight and improves performance. However, vulnerabilities in Git LFS can expose users to security risks, particularly when handling network protocols.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 pertains to an incorrect parsing of IPv6 host literals in the net/url package used by Git LFS. This flaw can lead to improper handling of URLs, potentially allowing attackers to exploit the system by crafting malicious URLs that could be misinterpreted. The ramifications of this vulnerability include unauthorized access to sensitive data, potential data corruption, and a compromise of the integrity of the Git repository.
How To Fix
Minimum fixed version
3.6.1-8.el9_7
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using IPv6 addresses in their Git LFS configurations until the update is applied. This can be done by specifying IPv4 addresses or using domain names instead.
Conclusion
In summary, the Git LFS vulnerability CVE-2026-25679 poses significant security risks due to incorrect parsing of IPv6 host literals. Users are strongly advised to update to the patched version 3.6.1-8.el9_7 to mitigate these risks. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files more efficiently by replacing them with text pointers and storing the actual files on a remote server.
CVE-2026-25679 is a security vulnerability in Git LFS that involves incorrect parsing of IPv6 host literals, which could lead to security risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized access to sensitive data, potential data corruption, and compromise of the integrity of the Git repository.
It is recommended to regularly check for updates and apply them promptly to ensure that your software is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
