Critical Security Update for Git LFS: Denial of Service Vulnerability
Summary
ALSA-2026:39266: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-12.el8_10. Fixed in 3.4.1-12.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is essential for developers who work with large assets, ensuring that their repositories remain lightweight and manageable. However, vulnerabilities in Git LFS can expose users to significant security risks, including denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-33811 affects the Go net package used in Git LFS. It allows an attacker to exploit a long CNAME response in the LookupCNAME function, potentially leading to a denial of service. This means that an attacker could cause the application to become unresponsive, impacting the availability of services that rely on Git LFS. The ramifications of this vulnerability can be severe, especially for organizations that depend on Git LFS for critical development workflows.
How To Fix
Minimum fixed version
3.4.1-12.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As of now, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as it is available.
Conclusion
In summary, the vulnerability CVE-2026-33811 in Git LFS poses a significant risk of denial of service. Users are strongly encouraged to update to the patched version 3.4.1-12.el8_10 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can further enhance your security posture.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers in the repository.
CVE-2026-33811 refers to a vulnerability in the Go net package that can lead to a denial of service through long CNAME responses.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not updating Git LFS could leave your application vulnerable to denial of service attacks, which can disrupt your development workflow.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
