Skip to content
OpenAdvisories
High RLSA-2026:97284 2 CVEs

Important: git-lfs security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Rocky Linux

Summary

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Fixed packages 12

ReleasePackageFixed in
Rocky Linux · 10 git-lfs 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debuginfo 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debuginfo 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debuginfo 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debuginfo 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debugsource 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debugsource 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debugsource 0:3.7.1-6.el10
Rocky Linux · 10 git-lfs-debugsource 0:3.7.1-6.el10

Vulnerabilities 2

  • High 7.5
    CVE-2026-32281

    Inefficient policy validation in crypto/x509

    Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chain…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.5
    CVE-2026-33810

    Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

    When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456333
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2456335
  • advisory
    https://access.redhat.com/errata/RHSA-2026:97284