Critical Security Update for Git LFS: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:64788: Important: git-lfs security update. Affects git-lfs versions < 3.7.1-5.el10_2.7. Fixed in 3.7.1-5.el10_2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, ensuring that repositories remain lightweight and manageable. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, compromising the integrity and availability of applications utilizing Git LFS.
Vulnerability Detail
The vulnerabilities stem from issues in the Go programming language libraries used by Git LFS. Specifically, the vulnerabilities include: 1) Denial of Service via excessive recursion in the Unmarshal function of the encoding/asn1 package (CVE-2026-33818), 2) Denial of Service from quadratic complexity in path resolution in the net/url package (CVE-2026-56860), and 3) Denial of Service via indefinite KeyUpdate messages in the crypto/tls package (CVE-2026-56862). These vulnerabilities could allow attackers to exploit the affected components, potentially leading to service outages and degraded performance.
How To Fix
Minimum fixed version
3.7.1-5.el10_2.7
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the update, consider limiting the exposure of your application to untrusted inputs that could exploit these vulnerabilities. Additionally, monitor your application for unusual behavior that may indicate a DoS attack.
Conclusion
In summary, the identified vulnerabilities in Git LFS pose significant risks that could lead to Denial of Service attacks. It is crucial for users to update to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers while storing the actual files on a remote server.
The vulnerabilities can lead to Denial of Service attacks, which may disrupt the availability and performance of applications using Git LFS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Implement workarounds such as limiting exposure to untrusted inputs and monitoring your application for unusual behavior until you can apply the update.
For detailed information, refer to the CVE pages listed in the vulnerability report, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
