Issued:: 2026-06-29
Updated:: 2026-06-29

RHSA-2026:30854 - Security Advisory

Overview
Updated Packages

Synopsis

Important: git-lfs security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for git-lfs is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux for x86_64 9 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
Red Hat Enterprise Linux for IBM z Systems 9 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
Red Hat Enterprise Linux for Power, little endian 9 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
Red Hat Enterprise Linux for ARM 64 9 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

CVEs

CVE-2026-39821

References

https://access.redhat.com/security/updates/classification/#important

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 9

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
x86_64
git-lfs-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 03e7fe309afb1efb7682dc118ab21c20b014426607b7159d3831f32faefd862c
git-lfs-debuginfo-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 3059197547e9cbabffd0316ad1843b870bae734743de9279a06c9e3b33ac4531
git-lfs-debugsource-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 924358dea288711b82e521b99f609444f1ac85168ade4e2bd3eb9e969ebbdae0

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
x86_64
git-lfs-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 03e7fe309afb1efb7682dc118ab21c20b014426607b7159d3831f32faefd862c
git-lfs-debuginfo-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 3059197547e9cbabffd0316ad1843b870bae734743de9279a06c9e3b33ac4531
git-lfs-debugsource-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 924358dea288711b82e521b99f609444f1ac85168ade4e2bd3eb9e969ebbdae0

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
s390x
git-lfs-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: c995f662df5482fc90d2ff849aeb158f56a557ca0b4e7053b59deaa43d8284ae
git-lfs-debuginfo-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: e4d9640a5f9ec52bb134bed0c184d2277e4b9e7a1119c9b0a2429727904cf994
git-lfs-debugsource-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: 434dde6179ba5525e0e58c8874a297585a355e8cf1cd7d54ac789dc8e5ea2563

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
s390x
git-lfs-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: c995f662df5482fc90d2ff849aeb158f56a557ca0b4e7053b59deaa43d8284ae
git-lfs-debuginfo-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: e4d9640a5f9ec52bb134bed0c184d2277e4b9e7a1119c9b0a2429727904cf994
git-lfs-debugsource-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: 434dde6179ba5525e0e58c8874a297585a355e8cf1cd7d54ac789dc8e5ea2563

Red Hat Enterprise Linux for Power, little endian 9

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
ppc64le
git-lfs-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 4d493d1a0783f10e345b6e100e96a87d39242137610b10c18cd5006c7cf7b4d1
git-lfs-debuginfo-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: ca351f31442e85ba02780e0ad113a99f26a9061c97ff71539a0e044e3ea166c3
git-lfs-debugsource-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 02ca0318b7dd69dadc1ba11cfa8fdb1fc97942012af9bef5e4a22cb30ceac23f

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
ppc64le
git-lfs-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 4d493d1a0783f10e345b6e100e96a87d39242137610b10c18cd5006c7cf7b4d1
git-lfs-debuginfo-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: ca351f31442e85ba02780e0ad113a99f26a9061c97ff71539a0e044e3ea166c3
git-lfs-debugsource-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 02ca0318b7dd69dadc1ba11cfa8fdb1fc97942012af9bef5e4a22cb30ceac23f

Red Hat Enterprise Linux for ARM 64 9

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
aarch64
git-lfs-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 046e458a4d9b8781124e65380ffb371435472236d6c06dd382d204d308199d51
git-lfs-debuginfo-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 51f6d3add7c53ae12c15cf0db6038ecc7174acdbe5c3b9cf3e4f87ebda0273a8
git-lfs-debugsource-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 33064461a85024e2cf9c341ce601fb808781b179a437baa5000b761b7607ffa0

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
aarch64
git-lfs-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 046e458a4d9b8781124e65380ffb371435472236d6c06dd382d204d308199d51
git-lfs-debuginfo-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 51f6d3add7c53ae12c15cf0db6038ecc7174acdbe5c3b9cf3e4f87ebda0273a8
git-lfs-debugsource-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 33064461a85024e2cf9c341ce601fb808781b179a437baa5000b761b7607ffa0

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
ppc64le
git-lfs-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 4d493d1a0783f10e345b6e100e96a87d39242137610b10c18cd5006c7cf7b4d1
git-lfs-debuginfo-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: ca351f31442e85ba02780e0ad113a99f26a9061c97ff71539a0e044e3ea166c3
git-lfs-debugsource-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 02ca0318b7dd69dadc1ba11cfa8fdb1fc97942012af9bef5e4a22cb30ceac23f

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
x86_64
git-lfs-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 03e7fe309afb1efb7682dc118ab21c20b014426607b7159d3831f32faefd862c
git-lfs-debuginfo-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 3059197547e9cbabffd0316ad1843b870bae734743de9279a06c9e3b33ac4531
git-lfs-debugsource-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 924358dea288711b82e521b99f609444f1ac85168ade4e2bd3eb9e969ebbdae0

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
aarch64
git-lfs-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 046e458a4d9b8781124e65380ffb371435472236d6c06dd382d204d308199d51
git-lfs-debuginfo-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 51f6d3add7c53ae12c15cf0db6038ecc7174acdbe5c3b9cf3e4f87ebda0273a8
git-lfs-debugsource-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 33064461a85024e2cf9c341ce601fb808781b179a437baa5000b761b7607ffa0

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
s390x
git-lfs-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: c995f662df5482fc90d2ff849aeb158f56a557ca0b4e7053b59deaa43d8284ae
git-lfs-debuginfo-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: e4d9640a5f9ec52bb134bed0c184d2277e4b9e7a1119c9b0a2429727904cf994
git-lfs-debugsource-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: 434dde6179ba5525e0e58c8874a297585a355e8cf1cd7d54ac789dc8e5ea2563

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
x86_64
git-lfs-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 03e7fe309afb1efb7682dc118ab21c20b014426607b7159d3831f32faefd862c
git-lfs-debuginfo-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 3059197547e9cbabffd0316ad1843b870bae734743de9279a06c9e3b33ac4531
git-lfs-debugsource-3.7.1-4.el9_8.1.x86_64.rpm	SHA-256: 924358dea288711b82e521b99f609444f1ac85168ade4e2bd3eb9e969ebbdae0

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
aarch64
git-lfs-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 046e458a4d9b8781124e65380ffb371435472236d6c06dd382d204d308199d51
git-lfs-debuginfo-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 51f6d3add7c53ae12c15cf0db6038ecc7174acdbe5c3b9cf3e4f87ebda0273a8
git-lfs-debugsource-3.7.1-4.el9_8.1.aarch64.rpm	SHA-256: 33064461a85024e2cf9c341ce601fb808781b179a437baa5000b761b7607ffa0

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
ppc64le
git-lfs-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 4d493d1a0783f10e345b6e100e96a87d39242137610b10c18cd5006c7cf7b4d1
git-lfs-debuginfo-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: ca351f31442e85ba02780e0ad113a99f26a9061c97ff71539a0e044e3ea166c3
git-lfs-debugsource-3.7.1-4.el9_8.1.ppc64le.rpm	SHA-256: 02ca0318b7dd69dadc1ba11cfa8fdb1fc97942012af9bef5e4a22cb30ceac23f

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.1.src.rpm	SHA-256: 0b6dfd55e491084f55f3bfba084b221e3d1356e62507610f2d8445c7b5618041
s390x
git-lfs-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: c995f662df5482fc90d2ff849aeb158f56a557ca0b4e7053b59deaa43d8284ae
git-lfs-debuginfo-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: e4d9640a5f9ec52bb134bed0c184d2277e4b9e7a1119c9b0a2429727904cf994
git-lfs-debugsource-3.7.1-4.el9_8.1.s390x.rpm	SHA-256: 434dde6179ba5525e0e58c8874a297585a355e8cf1cd7d54ac789dc8e5ea2563

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation