Critical Security Update for Git LFS: Mitigating Denial of Service Vulnerability
Summary
ALSA-2026:39272: Important: git-lfs security update. Affects git-lfs versions < 3.7.1-5.el10_2.6. Fixed in 3.7.1-5.el10_2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files efficiently. It replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git while storing the actual file contents on a remote server. This functionality is crucial for developers working with large assets, as it optimizes repository size and performance. However, a recent vulnerability has been identified that could potentially expose users to denial of service attacks.
Vulnerability Detail
The vulnerability arises from a flaw in the Go net package used by Git LFS, specifically in the LookupCNAME function. An attacker can exploit this vulnerability by sending a long CNAME response, which may lead to a denial of service condition. This could disrupt the availability of the Git LFS service, affecting users' ability to access or manage their large files effectively. The issue is tracked under CVE-2026-33811.
How To Fix
Minimum fixed version
3.7.1-5.el10_2.6
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of Git LFS for critical operations until the package is updated. Additionally, monitoring network traffic for unusual CNAME responses may help mitigate potential attacks.
Conclusion
In summary, the identified vulnerability in Git LFS poses a significant risk of denial of service attacks. Users are strongly encouraged to update to the latest patched version to mitigate this risk. Temporary workarounds can be employed until the update is applied. For ongoing monitoring of vulnerabilities, consider using tools like Vulert.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers in the repository.
The vulnerability allows for a denial of service attack through a long CNAME response in the Go net package used by Git LFS.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider limiting the use of Git LFS for critical operations and monitor network traffic for unusual activity.
More information about the CVE can be found on the official CVE page for CVE-2026-33811.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
