Critical Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19350: Important: git-lfs security update. Affects git-lfs versions < 3.7.1-4.el9_8. Fixed in 3.7.1-4.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, as it optimizes repository size and performance. However, vulnerabilities in Git LFS can expose users to security risks, necessitating timely updates and patches.
Vulnerability Detail
The vulnerabilities identified in Git LFS stem from various components of the Go programming language, which Git LFS relies on. Notable issues include incorrect parsing of IPv6 host literals (CVE-2026-25679), a potential for root-level permission issues when following symlinks (CVE-2026-32282), and denial of service vulnerabilities related to TLS 1.3 key updates and certificate chain building (CVE-2026-32280, CVE-2026-32283). These vulnerabilities could allow attackers to exploit the system, leading to unauthorized access or service disruptions.
How To Fix
Minimum fixed version
3.7.1-4.el9_8
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their systems by avoiding the use of vulnerable features until the update is applied. Additionally, users should monitor their systems for any unusual activity that may indicate exploitation attempts.
Conclusion
The recent vulnerabilities in Git LFS highlight the importance of maintaining up-to-date software to protect against potential security threats. Users are strongly encouraged to apply the necessary updates to safeguard their systems and data.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers while storing the actual files on a remote server.
The vulnerabilities include incorrect IPv6 parsing, root permission issues with symlinks, and denial of service vulnerabilities in TLS and certificate handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, limit the use of vulnerable features and monitor your system for any suspicious activity.
More information can be found on the CVE pages linked in the advisory, which detail the impact and technical aspects of each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
