Critical Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:14200: Important: git-lfs security update. Affects git-lfs versions < 3.6.1-8.el9_7.1. Fixed in 3.6.1-8.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is essential for developers working with large assets, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerabilities identified in Git LFS stem from issues in the underlying Go libraries. Specifically, the vulnerabilities include: 1) CVE-2026-32282, where the Root.Chmod function can follow symlinks out of the root, potentially allowing unauthorized file access. 2) CVE-2026-32283, which presents a Denial of Service risk through multiple TLS 1.3 key update messages. 3) CVE-2026-32280, which involves a Denial of Service vulnerability in the certificate chain building process. These vulnerabilities can lead to unauthorized access and service disruptions, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
3.6.1-8.el9_7.1
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of symlinks in their Git repositories and monitor TLS connections closely until the update is applied. Additionally, consider using alternative methods for managing large files if immediate updates are not feasible.
Conclusion
The vulnerabilities in Git LFS pose significant risks, including unauthorized access and Denial of Service attacks. It is crucial for users to update to the latest patched version to ensure the security of their applications. Utilizing tools like Vulert can help monitor and manage these vulnerabilities effectively.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers, while the actual files are stored on a remote server.
The main vulnerabilities include unauthorized file access through symlink manipulation, Denial of Service via TLS key updates, and issues in certificate chain building.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
As a workaround, limit the use of symlinks and monitor your TLS connections until you can apply the necessary updates.
For detailed information, refer to the CVE pages associated with the vulnerabilities: CVE-2026-32280, CVE-2026-32282, and CVE-2026-32283.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
