Critical Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:19133: Important: git-lfs security update. Affects git-lfs versions < 0:3.7.1-4.el10_2. Fixed in 0:3.7.1-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerabilities in Git LFS stem from several issues in its underlying libraries. Notably, incorrect parsing of IPv6 host literals (CVE-2026-25679) can lead to security misconfigurations. Additionally, the Root.Chmod function in the internal syscall can follow symlinks out of the root directory (CVE-2026-32282), which may allow unauthorized access to sensitive files. Furthermore, there are denial of service vulnerabilities in the crypto/tls library (CVE-2026-32283) and during certificate chain building (CVE-2026-32280), which can disrupt service availability. The CVSS score for these vulnerabilities is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:3.7.1-4.el10_2
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their systems by restricting access to the affected components and monitoring for unusual activity until the update can be applied.
Conclusion
The vulnerabilities identified in Git LFS pose significant risks to users, particularly in terms of security misconfigurations and denial of service attacks. It is crucial to update to the latest patched version to ensure the integrity and availability of your applications. Utilizing tools like Vulert can further enhance your security posture by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers in the repository.
The vulnerabilities include incorrect IPv6 parsing, symlink following in Root.Chmod, and denial of service issues in the crypto/tls library.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The CVSS score for these vulnerabilities is 7.8, indicating a high severity level.
Run 'sudo dnf update git-lfs' in your terminal to update to the patched version 0:3.7.1-4.el10_2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
