Critical Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:16875: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-10.el8_10. Fixed in 3.4.1-10.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, as it optimizes repository size and performance. However, recent vulnerabilities have been identified that could compromise the security of Git LFS users.
Vulnerability Detail
The vulnerabilities in Git LFS stem from several issues in its underlying libraries. Notably, incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679) could lead to potential security risks. Additionally, the internal syscall/unix package has a flaw where Root.Chmod can follow symlinks out of the root (CVE-2026-32282). Furthermore, there are Denial of Service vulnerabilities in the crypto/tls package, which could be exploited through multiple TLS 1.3 key update messages (CVE-2026-32283) and in certificate chain building (CVE-2026-32280). These vulnerabilities could allow attackers to disrupt service or gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
3.4.1-10.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using features that rely on the affected packages until the update is applied. Additionally, ensure that your network configurations do not expose your system to potential attacks related to the vulnerabilities mentioned.
Conclusion
In summary, the recent security update for Git LFS addresses critical vulnerabilities that could impact users. It is essential to update to the latest version to mitigate risks associated with these vulnerabilities. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts without requiring code access.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers while storing the actual content on a remote server.
The vulnerabilities include incorrect parsing of IPv6 addresses, potential symlink attacks, and Denial of Service issues in TLS and certificate chain building.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid using features that rely on the affected packages and ensure your network is secure.
For more details, refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.