Red Hat Security Advisory: git-lfs security update

Fixed packages 3

Vulnerabilities 12

• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• Critical 9.1
  CVE-2025-68121

  Unexpected session resumption in crypto/tls

  During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

  Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026
• High 7.5
  CVE-2026-32280

  Unexpected work during chain building in crypto/x509

  During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-32281

  Inefficient policy validation in crypto/x509

  Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-32283

  Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

  If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-33811

  Crash when handling long CNAME response in net

  When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-33818

  Enforce maximum recursion depth in encoding/asn1

  Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

  Go standard library encoding/asn1 katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-42504

  Quadratic complexity in WordDecoder.DecodeHeader in mime

  Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

  Go standard library mime golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 2, 2026
• High 7.5
  CVE-2026-56859

  Add recursion depth guard during decode in encoding/xml

  Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

  Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• High 7.5
  CVE-2026-56862

  Limit handshake messages we are willing to accept post-handshake in crypto/tls

  Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key deriva…

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026
• Medium 6.4
  CVE-2026-32282

  TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

  On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

  Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 5.9
  CVE-2026-56860

  Avoid quadratic complexity in resolvePath in net/url

  Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…

  Go standard library net/url katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 13, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2437111
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2480756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484204
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515815
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2515840
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72276.json
• report
  https://access.redhat.com/security/cve/CVE-2025-68121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68121
• article
  https://go.dev/cl/737700
• article
  https://go.dev/issue/77217
• article
  https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4337
• report
  https://access.redhat.com/security/cve/CVE-2026-32280
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32280
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32280
• article
  https://go.dev/cl/758320
• article
  https://go.dev/issue/78282
• article
  https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
• advisory
  https://pkg.go.dev/vuln/GO-2026-4947
• report
  https://access.redhat.com/security/cve/CVE-2026-32281
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32281
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32281
• article
  https://go.dev/cl/758061
• article
  https://go.dev/issue/78281
• advisory
  https://pkg.go.dev/vuln/GO-2026-4946
• report
  https://access.redhat.com/security/cve/CVE-2026-32282
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32282
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32282
• article
  https://go.dev/cl/763761
• article
  https://go.dev/issue/78293