Critical Security Update for Git LFS: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:67161: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-13.el8_10. Fixed in 3.4.1-13.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, enabling smoother version control and collaboration. However, vulnerabilities in its underlying libraries can expose users to security risks.
Vulnerability Detail
The vulnerabilities identified in Git LFS stem from issues in the Go programming language libraries it utilizes. Specifically, there are three Denial of Service (DoS) vulnerabilities: 1) Excessive recursion in the Unmarshal function of the encoding/asn1 package (CVE-2026-33818), which can lead to application crashes; 2) Quadratic complexity in path resolution in the net/url package (CVE-2026-56860), potentially causing significant performance degradation; and 3) Indefinite KeyUpdate messages in the crypto/tls package (CVE-2026-56862), which can also result in service interruptions. These vulnerabilities can be exploited by attackers to disrupt service availability, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
3.4.1-13.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to update to the patched version as soon as it is available.
Conclusion
The identified vulnerabilities in Git LFS pose significant risks, particularly in terms of Denial of Service attacks. Users are strongly encouraged to update to the latest patched version to safeguard their applications and maintain service availability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers in the repository.
The vulnerabilities include Denial of Service issues related to excessive recursion, quadratic complexity in path resolution, and indefinite KeyUpdate messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version to mitigate the risks associated with these vulnerabilities.
For more details, refer to the CVE pages listed in the vulnerability report, which provide in-depth information about the impact and technical aspects.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
