GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

Oracle Linux 10 : git-lfs (ELSA-2026-19133)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19133 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 10 : git-lfs (ELSA-2026-30855)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30855 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 10 : git-lfs (ELSA-2026-39272)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39272 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 8 : git-lfs (ELSA-2026-39266)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39266 advisory. 3.4.1-12 - Rebuild with new Golang - Resolves: RHEL-187191 Tenable has extracted the preceding description block directly from the Oracle Linux security...

MiracleLinux 8 : git-lfs-3.4.1-12.el8_10 (AXSA:2026-1269:09)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1269:09 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

RockyLinux 8 : git-lfs (RLSA-2026:39266)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39266 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

AlmaLinux 10 : git-lfs (ALSA-2026:39272)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39272 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

AlmaLinux 8 : git-lfs (ALSA-2026:39266)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39266 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...

AlmaLinux 9 : git-lfs (ALSA-2026:39319)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39319 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...

RockyLinux 9 : git-lfs (RLSA-2026:39319)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39319 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

Oracle Linux 9 : git-lfs (ELSA-2026-39319)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39319 advisory. 3.7.1-4.2 - Rebuild with new Golang - Resolves: RHEL-187329 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 10 : git-lfs (RHSA-2026:39272)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39272 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing...

ALSA-2026:39319 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME...

ALSA-2026:39266 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME...

CLEANSTART-2026-PF75550 Security fixes for CVE-2021-38561, CVE-2022-27191 applied in versions: 3.1.2-r3, 3.1.2-r4

Multiple security vulnerabilities affect the git-lfs package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DY26014 Security fixes for CVE-2021-38561, CVE-2022-27191 applied in versions: 3.1.2-r3, 3.1.2-r4

Multiple security vulnerabilities affect the git-lfs package. These issues are resolved in later releases. See references for individual vulnerability details...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8 (AXSA:2026-1205:08)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1205:08 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the...

MiracleLinux 8 : git-lfs-3.4.1-11.el8_10 (AXSA:2026-1139:07)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1139:07 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...