Critical Security Update for Git LFS: Denial of Service Vulnerability
Summary
ALSA-2026:2323: Important: git-lfs security update. Affects git-lfs versions < 3.4.1-7.el8_10. Fixed in 3.4.1-7.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who need to handle large assets without bloating their repositories. However, a recent vulnerability has been identified that could lead to denial of service due to excessive resource consumption when processing crafted certificates.
Vulnerability Detail
The vulnerability, identified as CVE-2025-61729, arises from the way Git LFS handles certain cryptographic operations related to x509 certificates. An attacker could exploit this vulnerability by crafting a malicious certificate that, when processed by the Git LFS, consumes excessive system resources, potentially leading to a denial of service. This could disrupt services relying on Git LFS, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
3.4.1-7.el8_10
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability other than updating to the patched version. Users are advised to monitor their systems for any unusual behavior and apply the update as soon as possible.
Conclusion
The identified vulnerability in Git LFS poses a significant risk of denial of service due to excessive resource consumption. Users are strongly encouraged to update to the patched version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining the security of software dependencies.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers in the repository.
CVE-2025-61729 is a vulnerability in Git LFS that can lead to denial of service due to excessive resource consumption when processing crafted certificates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your systems for unusual activity until you can apply the update.
For more details, refer to the CVE page associated with CVE-2025-61729, which provides comprehensive information about the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
