Critical Security Flaw in Git LFS: Important Update Required
Summary
RLSA-2026:19350: Important: git-lfs security update. Affects git-lfs versions < 0:3.7.1-4.el9_8. Fixed in 0:3.7.1-4.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, but it also introduces potential security vulnerabilities that need to be addressed promptly.
Vulnerability Detail
The vulnerability in Git LFS arises from several security issues within its underlying libraries. Notably, incorrect parsing of IPv6 host literals in the net/url package (CVE-2026-25679) can lead to potential misrouting of data. Additionally, the internal syscall for Unix systems allows Root.Chmod to follow symlinks out of the root (CVE-2026-32282), which could lead to unauthorized file access. Furthermore, there are Denial of Service vulnerabilities in the crypto/tls package, where multiple TLS 1.3 key update messages (CVE-2026-32283) and issues in certificate chain building (CVE-2026-32280) can disrupt secure communications. These vulnerabilities could allow attackers to exploit the system, leading to data breaches or service interruptions.
How To Fix
Minimum fixed version
0:3.7.1-4.el9_8
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure to these vulnerabilities by avoiding the use of symlinks in critical directories and ensuring that their network configurations do not allow for the exploitation of IPv6 parsing issues. However, these are not long-term solutions, and updating the package is strongly recommended.
Conclusion
The recent vulnerabilities in Git LFS highlight the importance of keeping software up to date to mitigate security risks. By updating to the latest version, users can protect their systems from potential exploits and ensure the integrity of their large file management.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers while storing the actual files on a remote server.
The vulnerabilities include incorrect IPv6 parsing, symlink issues in Root.Chmod, and Denial of Service vulnerabilities in TLS and certificate chain building.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
It is recommended to regularly check for updates and apply them promptly to ensure that you are protected against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
