Critical Security Update for Git LFS: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:66364: Important: git-lfs security update. Affects git-lfs versions < 3.7.1-4.el9_8.3. Fixed in 3.7.1-4.el9_8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, as it streamlines version control and reduces repository size. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, impacting the reliability of Git LFS.
Vulnerability Detail
The vulnerabilities in Git LFS stem from issues in the Go programming language libraries it utilizes. Specifically, there are three critical vulnerabilities: 1) CVE-2026-33818 in the encoding/asn1 package, which allows for Denial of Service via excessive recursion during the Unmarshal process; 2) CVE-2026-56860 in the net/url package, which can cause Denial of Service due to quadratic complexity in path resolution; and 3) CVE-2026-56862 in the crypto/tls package, which permits Denial of Service through indefinite KeyUpdate messages. These vulnerabilities can be exploited by attackers to disrupt service availability, leading to potential downtime and loss of productivity.
How To Fix
Minimum fixed version
3.7.1-4.el9_8.3
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of affected functionalities in Git LFS until the update is applied. Avoid processing large files that may trigger the vulnerabilities, and monitor system performance closely for any unusual behavior.
Conclusion
In summary, Git LFS has critical vulnerabilities that could lead to Denial of Service attacks. It is crucial for users to update to the latest patched version to mitigate these risks. By following the outlined steps and utilizing resources like Vulert, users can ensure their applications remain secure.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that helps manage large files by replacing them with text pointers and storing the actual files on a remote server.
The main vulnerabilities include Denial of Service issues in the Go encoding/asn1, net/url, and crypto/tls packages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, limit the use of functionalities that may trigger the vulnerabilities and monitor your system for unusual behavior.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about the impact and technical aspects.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
