Critical Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19133: Important: git-lfs security update. Affects git-lfs versions < 3.7.1-4.el10_2. Fixed in 3.7.1-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, as it helps maintain repository performance and reduces the size of the repository. However, recent vulnerabilities have been identified that could compromise the security of Git LFS installations.
Vulnerability Detail
The vulnerabilities in Git LFS stem from several issues in its underlying libraries. Notably, incorrect parsing of IPv6 host literals (CVE-2026-25679) can lead to potential security breaches. Additionally, a flaw in the Root.Chmod function (CVE-2026-32282) allows it to follow symlinks out of the root directory, posing a risk of unauthorized file access. Furthermore, denial of service vulnerabilities in the Go crypto/tls library (CVE-2026-32283) and in certificate chain building (CVE-2026-32280) could disrupt service availability, making it critical for users to address these issues promptly.
How To Fix
Minimum fixed version
3.7.1-4.el10_2
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their Git LFS installations by restricting access to the repository and monitoring for any unusual activity. Additionally, consider disabling features that rely on the affected libraries until the update is applied.
Conclusion
The recent vulnerabilities in Git LFS highlight the importance of maintaining updated software to protect against potential security risks. Users are strongly encouraged to apply the necessary updates to mitigate these vulnerabilities and ensure the integrity of their development environment.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers in the repository.
The identified vulnerabilities include incorrect parsing of IPv6 host literals, unauthorized symlink following, and denial of service issues in the Go crypto/tls library.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application at Vulert Scanner without any signup.
If an immediate update is not possible, implement workarounds such as restricting repository access and monitoring for unusual activity.
For detailed information about the vulnerabilities, refer to the CVE pages listed in the advisory or consult the official Git LFS documentation.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
