Critical Security Update for Git LFS: Denial of Service Vulnerability
Summary
ALSA-2026:39319: Important: git-lfs security update. Affects git-lfs versions < 3.7.1-4.el9_8.2. Fixed in 3.7.1-4.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who need to handle large assets without bloating their repositories. However, a recent vulnerability has been identified that could potentially expose users to denial of service attacks.
Vulnerability Detail
The vulnerability arises from the Go net package used in Git LFS, specifically in the LookupCNAME function. An attacker could exploit this vulnerability by sending a long CNAME response, leading to a denial of service condition. This could result in the application becoming unresponsive, affecting the availability of services that rely on Git LFS for large file management. The vulnerability is tracked under CVE-2026-33811 and poses a significant risk to users who rely on Git LFS for their development workflows.
How To Fix
Minimum fixed version
3.7.1-4.el9_8.2
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their Git LFS services by implementing network-level controls to filter out malicious requests. Additionally, monitoring for unusual patterns in DNS responses may help mitigate the risk until the package is updated.
Conclusion
In summary, the Git LFS package has a critical vulnerability that could lead to denial of service attacks. Users are strongly advised to update to the patched version 3.7.1-4.el9_8.2 to mitigate this risk. Implementing temporary workarounds can help reduce exposure until the update is applied.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers while storing the actual content on a remote server.
The vulnerability is a denial of service issue caused by a long CNAME response in the Go net package's LookupCNAME function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing network-level controls to filter out potentially malicious requests as a temporary workaround.
For more details, refer to the CVE page associated with CVE-2026-33811, which provides in-depth information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
