[ALSA-2026:64788] Important: git-lfs security update
Type:
security
Severity:
important
Release date:
2026-09-08
Description:
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 git-lfs-3.7.1-5.el10_2.7.aarch64.rpm bdc912e8e9c70a67b81b87ca06d75706e176ec84ef96838903b2c6668aed99b2
ppc64le git-lfs-3.7.1-5.el10_2.7.ppc64le.rpm 7ff9af0322688cd1257ca8402caee5d07640944cf3061288668bb3bb362cf3ce
s390x git-lfs-3.7.1-5.el10_2.7.s390x.rpm 0849658a64898db2be7a2402037b2791d30382a74a43a0c7ae58fcd1564d3b5a
x86_64 git-lfs-3.7.1-5.el10_2.7.x86_64.rpm da9124ff6de216c5bc39749a408a050c01ddcfcbf444a046cbcef4c003c9175b
x86_64_v2 git-lfs-3.7.1-5.el10_2.7.x86_64_v2.rpm e670ab9d3b9eef42e5d60f4548ba385b6e60f1d142b93e5846988c3d63743877
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.