High ELSA-2026-39272 1 CVE

Important: git-lfs security update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[3.7.1-6]
- Rebuild with new Golang

[3.7.1-5]
- Fix CVE-2026-39821 in vendored golang.org/x/net idna package

[3.7.1-4]
- Rebuild with new Golang

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 10	git-lfs	0:3.7.1-5.el10_2.6

Vulnerabilities 1

High 7.5

CVE-2026-33811

Crash when handling long CNAME response in net

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

May 7, 2026