CLEANSTART-2026-CS42741 Security fixes in git-lfs 3.7.0-r1

Package git-lfs version 3.7.0-r1 fixes 3 vulnerabilities: CVE-2025-68121, CVE-2025-61732, CVE-2022-3219...

CLEANSTART-2026-QQ25603 Security fixes in git-lfs 3.1.2-r3

Package git-lfs version 3.1.2-r3 fixes 1 vulnerabilities: CVE-2021-38561...

CLEANSTART-2026-QB92274 Security fixes in git-lfs 3.7.0-r3

Package git-lfs version 3.7.0-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CLEANSTART-2026-XM62269 Security fixes in git-lfs-fips 3.7.0-r2

Package git-lfs-fips version 3.7.0-r2 fixes 11 vulnerabilities: CVE-2025-47911, CVE-2025-47914, CVE-2025-58181, CVE-2025-58190, CVE-2025-61730...

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5

CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5. A patched version of the package is available...

GO-2026-6029 Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects in code.gitea.io/gitea...

Oracle Linux 10 : git-lfs (ELSA-2026-19133)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19133 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 10 : git-lfs (ELSA-2026-30855)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30855 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the JWT authorization. An attacker can gain unauthorized access to LFS objects belonging to other repositories by leveraging a write deploy key and knowledge of valid object...

Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

EUVD-2026-41606

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

AZL-93186 CVE-2026-56852 affecting package git-lfs for versions less than 3.6.1-5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be caused by...

Oracle Linux 10 : git-lfs (ELSA-2026-39272)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39272 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

MiracleLinux 8 : git-lfs-3.4.1-12.el8_10 (AXSA:2026-1269:09)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1269:09 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block...

Oracle Linux 8 : git-lfs (ELSA-2026-39266)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39266 advisory. 3.4.1-12 - Rebuild with new Golang - Resolves: RHEL-187191 Tenable has extracted the preceding description block directly from the Oracle Linux security...