Critical Security Update for Git LFS: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3928: Important: git-lfs security update. Affects git-lfs versions < 3.6.1-7.el9_7. Fixed in 3.6.1-7.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers working with large assets, as it optimizes repository size and performance. However, vulnerabilities in Git LFS can lead to severe security risks, including denial of service and memory exhaustion.
Vulnerability Detail
The vulnerabilities in Git LFS stem from issues in its underlying libraries, specifically in the Go programming language. The identified vulnerabilities include: 1) Denial of Service due to excessive resource consumption via crafted certificates (CVE-2025-61729), 2) Memory exhaustion in query parameter parsing (CVE-2025-61726), and 3) Unexpected session resumption in TLS (CVE-2025-68121). These vulnerabilities can be exploited by attackers to disrupt service availability, exhaust system resources, and compromise secure communications.
How To Fix
Minimum fixed version
3.6.1-7.el9_7
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as possible.
Conclusion
The vulnerabilities identified in Git LFS pose significant security risks that can affect the stability and security of applications utilizing this package. It is imperative for users to update to the latest patched version to safeguard against potential exploits. Regular monitoring and prompt updates are essential for maintaining software security.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files efficiently by replacing them with text pointers and storing the actual content on a remote server.
The main vulnerabilities include denial of service due to crafted certificates, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating Git LFS to mitigate the risks associated with these vulnerabilities.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
