Critical Security Update for Git LFS: Addressing Denial of Service and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:4164: Important: git-lfs security update. Affects git-lfs versions < 3.6.1-7.el10_1. Fixed in 3.6.1-7.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Git Large File Storage (LFS) is an extension for Git that allows users to manage large files such as audio samples, videos, datasets, and graphics efficiently. Instead of storing large files directly in the Git repository, Git LFS replaces them with text pointers, while the actual file contents are stored on a remote server. This functionality is crucial for developers who work with large assets, as it helps maintain repository performance and reduces cloning times. However, vulnerabilities in Git LFS can lead to severe security risks, including denial of service and memory exhaustion.
Vulnerability Detail
The vulnerabilities identified in Git LFS stem from issues in the underlying Go libraries. Specifically, CVE-2025-61729 allows for denial of service due to excessive resource consumption when processing crafted certificates. CVE-2025-61726 leads to memory exhaustion during query parameter parsing, which can crash applications. Additionally, CVE-2025-68121 involves unexpected session resumption in TLS, potentially allowing unauthorized access to sensitive data. These vulnerabilities can severely impact application stability and security, making timely updates essential.
How To Fix
Minimum fixed version
3.6.1-7.el10_1
This is the first release that contains the fix.
sudo dnf update git-lfsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of Git LFS for sensitive operations until the update is applied. Additionally, monitoring network traffic for unusual patterns may help mitigate potential exploitation of these vulnerabilities.
Conclusion
In summary, the recent vulnerabilities in Git LFS pose significant risks to application security and stability. It is crucial for users to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for git-lfs →
FAQ
Git LFS is an extension for Git that allows users to manage large files more efficiently by replacing them with text pointers in the repository.
The main vulnerabilities include denial of service due to excessive resource consumption, memory exhaustion during query parsing, and unexpected session resumption in TLS.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, limit the use of Git LFS for sensitive operations and monitor network traffic for any unusual activity.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2025-61726, CVE-2025-61729, and CVE-2025-68121.
Related vulnerabilities
Recent vulnerabilities recorded for git-lfs.
