Description
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| git-lfs | git-lfs | >= 0.1.0, < 3.6.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | git-lfs | 3.5.0-2 | — |
| Debian 13 | git-lfs | 3.5.0-2 | — |
| Debian 12 | git-lfs | 3.3.0-1+deb12u1 | DSA-5849-1 |
| Debian 11 | git-lfs | 2.13.2-1+deb11u1 | DLA-4028-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | git-lfs | 3.6.1-1ubuntu0.1 | USN-7977-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | git-lfs | 3.4.1-1ubuntu0.3+esm2 | USN-7977-1 |
| Ubuntu Pro 22.04 LTS | git-lfs | 3.0.2-1ubuntu0.3+esm2 | USN-7977-1 |
| Ubuntu Pro 20.04 LTS | git-lfs | 2.9.2-1ubuntu0.1~esm2 | USN-7977-1 |
| Ubuntu Pro 18.04 LTS | git-lfs | 2.3.4-1ubuntu0.1~esm1 | USN-7977-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | git-lfs | 3.4.1-4.el9_5 | RHSA-2025:0673 |
| RHEL 8 | git-lfs | 3.4.1-4.el8_10 | RHSA-2025:0845 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | git-lfs | 3.4.1-4.el9_4.1 | RHSA-2025:0759 |
| RHEL 9.2 EUS | git-lfs | 3.2.0-2.el9_2.2 | RHSA-2025:0757 |
| RHEL 9.0 E4S | git-lfs | 2.13.3-5.el9_0.3 | RHSA-2025:0758 |
| RHEL 8.8 EUS | git-lfs | 3.2.0-2.el8_8.3 | RHSA-2025:0762 |
| RHEL 8.6 TUS | git-lfs | 2.13.3-3.el8_6.3 | RHSA-2025:0765 |
| RHEL 8.6 E4S | git-lfs | 2.13.3-3.el8_6.3 | RHSA-2025:0765 |
| RHEL 8.6 AUS | git-lfs | 2.13.3-3.el8_6.3 | RHSA-2025:0765 |
| RHEL 8.4 TUS | git-lfs | 2.13.3-3.el8_4.1 | RHSA-2025:0825 |
| RHEL 8.4 E4S | git-lfs | 2.13.3-3.el8_4.1 | RHSA-2025:0825 |
| RHEL 8.4 AUS | git-lfs | 2.13.3-3.el8_4.1 | RHSA-2025:0825 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | git-lfs | 3.4.1-4.el9_5 | ALSA-2025:0673 |
| AlmaLinux 8 | git-lfs | 3.4.1-4.el8_10 | ALSA-2025:0845 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | git-lfs | 3.4.1-4.el9_4 | RLSA-2025:0673 |
| Rocky Linux 8 | git-lfs | 3.4.1-4.el8_10 | RLSA-2025:0845 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | govulncheck-vulndb | 0.0.20250128T150132-150000.1.29.1 | SUSE-SU-2025:0297-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | git-lfs | 3.6.1-bp156.2.3.1 | openSUSE-SU-2025:0153-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git-lfs | 3.6.1-1.1 | openSUSE-SU-2025:14649-1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250115T172141-1.1 | openSUSE-SU-2025:14653-1 |
| openSUSE Leap 15.6 | git-lfs | 3.6.1-bp156.2.3.1 | openSUSE-SU-2025:0153-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250128T150132-150000.1.29.1 | SUSE-SU-2025:0297-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | git-lfs | 3.4.0-78.amzn2023.0.4 | ALAS2023-2025-851 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | git-lfs | 3.6.1-1 | — |
| Azure Linux 2 (CBL-Mariner) | git-lfs | 3.5.1-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | git-lfs | 3.4.1-4.el9_5 | ELSA-2025-0673 |
| Oracle Linux 8 | git-lfs | 3.4.1-4.el8_10 | ELSA-2025-0845 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/git-lfs/git-lfs | >= 0.1.0, <= 3.0.0 | — | GHSA-q6r2-x2cc-vrp7 |
| Go | github.com/git-lfs/git-lfs | >= 0.1.0 | — | GO-2025-3390 |
| Go | github.com/git-lfs/git-lfs/v3 | >= 3.0.0, < 3.6.1 | 3.6.1 | GHSA-q6r2-x2cc-vrp7 |
Advisories 23
- ALSA-2025:0673 Important: git-lfs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:0845 Important: git-lfs security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-7977-1 git-lfs vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- RHSA-2025:0757 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0759 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0765 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0825 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0845 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0758 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0762 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- RHSA-2025:0673 Red Hat Security Advisory: git-lfs security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- DSA-5849-1 git-lfs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4028-1 git-lfs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2025:0297-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Feb 5, 2026
- RLSA-2025:0845 Important: git-lfs security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2025:0673 Important: git-lfs security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2025:0153-1 Security update for git-lfs SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14653-1 govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14649-1 git-lfs-3.6.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0186 Red Hat Enterprise Linux (git-lfs): Schwachstelle ermöglicht Erlangen von Benutzerrechten BSI CERT-Bund (WID) · Jan 26, 2026
- ALAS2023-2025-851 Important: git-lfs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 21, 2025
- ELSA-2025-0845 Important: git-lfs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 30, 2025
- ELSA-2025-0673 Important: git-lfs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 23, 2025