Red Hat Product Errata RHSA-2026:66364 - Security Advisory
Issued:
2026-09-10
Updated:
2026-09-10

RHSA-2026:66364 - Security Advisory

Synopsis

Important: git-lfs security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for git-lfs is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

  • encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

  • BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
  • BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
  • BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

Red Hat Enterprise Linux for x86_64 9

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
x86_64
git-lfs-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 35df42ac8b1c7231a0a54f67188c652cc270739f7387b61cfa286b73cd6b6d30
git-lfs-debuginfo-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 50474431882009a4b3bf30aabd7a5b2fb0a0173bd32e8346d1a67442d05567d6
git-lfs-debugsource-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: a5f31cfad482f0cdd16b9f4cb718438bed16879e711bc414a3c2f6681699824a

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
x86_64
git-lfs-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 35df42ac8b1c7231a0a54f67188c652cc270739f7387b61cfa286b73cd6b6d30
git-lfs-debuginfo-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 50474431882009a4b3bf30aabd7a5b2fb0a0173bd32e8346d1a67442d05567d6
git-lfs-debugsource-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: a5f31cfad482f0cdd16b9f4cb718438bed16879e711bc414a3c2f6681699824a

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
s390x
git-lfs-3.7.1-4.el9_8.3.s390x.rpm SHA-256: c83b117153a1a130c218f82d378e7f02c412927ba37a681974d66048d15576d7
git-lfs-debuginfo-3.7.1-4.el9_8.3.s390x.rpm SHA-256: 1705ff213488e7616d4509c951bbe8720e2b9377a8018ca003bd33ad2a9d98cd
git-lfs-debugsource-3.7.1-4.el9_8.3.s390x.rpm SHA-256: a5dbc4d1578798d412754395d54778e58228b8d1a12732cb6e44d8300e6b1b20

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
s390x
git-lfs-3.7.1-4.el9_8.3.s390x.rpm SHA-256: c83b117153a1a130c218f82d378e7f02c412927ba37a681974d66048d15576d7
git-lfs-debuginfo-3.7.1-4.el9_8.3.s390x.rpm SHA-256: 1705ff213488e7616d4509c951bbe8720e2b9377a8018ca003bd33ad2a9d98cd
git-lfs-debugsource-3.7.1-4.el9_8.3.s390x.rpm SHA-256: a5dbc4d1578798d412754395d54778e58228b8d1a12732cb6e44d8300e6b1b20

Red Hat Enterprise Linux for Power, little endian 9

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
ppc64le
git-lfs-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 14eb3e2046580a216550728d58c75ee4e984c21dddbd66125a233504748837fb
git-lfs-debuginfo-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 7aae55edeb9082564dea434166ab2c19733545c593578a1ef7b3f501b77d7bae
git-lfs-debugsource-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 49087e383555d46b344b3454afeeb7c330e2a8a59fa0f95cbb2993268a0f6d6d

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
ppc64le
git-lfs-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 14eb3e2046580a216550728d58c75ee4e984c21dddbd66125a233504748837fb
git-lfs-debuginfo-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 7aae55edeb9082564dea434166ab2c19733545c593578a1ef7b3f501b77d7bae
git-lfs-debugsource-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 49087e383555d46b344b3454afeeb7c330e2a8a59fa0f95cbb2993268a0f6d6d

Red Hat Enterprise Linux for ARM 64 9

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
aarch64
git-lfs-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 46fcb6f34490f575b318518eff43154b93f47278dd85b824a045f5997a92e1c8
git-lfs-debuginfo-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 476092b66015fe131984cd3fa96546c801e4100d580e765c67514b1c1a0cf45a
git-lfs-debugsource-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: e8155467612e4c10cd18a9afe5960684d7a8679083d6a936c03fc3199e7ee894

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
aarch64
git-lfs-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 46fcb6f34490f575b318518eff43154b93f47278dd85b824a045f5997a92e1c8
git-lfs-debuginfo-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 476092b66015fe131984cd3fa96546c801e4100d580e765c67514b1c1a0cf45a
git-lfs-debugsource-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: e8155467612e4c10cd18a9afe5960684d7a8679083d6a936c03fc3199e7ee894

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
ppc64le
git-lfs-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 14eb3e2046580a216550728d58c75ee4e984c21dddbd66125a233504748837fb
git-lfs-debuginfo-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 7aae55edeb9082564dea434166ab2c19733545c593578a1ef7b3f501b77d7bae
git-lfs-debugsource-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 49087e383555d46b344b3454afeeb7c330e2a8a59fa0f95cbb2993268a0f6d6d

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
x86_64
git-lfs-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 35df42ac8b1c7231a0a54f67188c652cc270739f7387b61cfa286b73cd6b6d30
git-lfs-debuginfo-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 50474431882009a4b3bf30aabd7a5b2fb0a0173bd32e8346d1a67442d05567d6
git-lfs-debugsource-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: a5f31cfad482f0cdd16b9f4cb718438bed16879e711bc414a3c2f6681699824a

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
aarch64
git-lfs-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 46fcb6f34490f575b318518eff43154b93f47278dd85b824a045f5997a92e1c8
git-lfs-debuginfo-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 476092b66015fe131984cd3fa96546c801e4100d580e765c67514b1c1a0cf45a
git-lfs-debugsource-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: e8155467612e4c10cd18a9afe5960684d7a8679083d6a936c03fc3199e7ee894

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
s390x
git-lfs-3.7.1-4.el9_8.3.s390x.rpm SHA-256: c83b117153a1a130c218f82d378e7f02c412927ba37a681974d66048d15576d7
git-lfs-debuginfo-3.7.1-4.el9_8.3.s390x.rpm SHA-256: 1705ff213488e7616d4509c951bbe8720e2b9377a8018ca003bd33ad2a9d98cd
git-lfs-debugsource-3.7.1-4.el9_8.3.s390x.rpm SHA-256: a5dbc4d1578798d412754395d54778e58228b8d1a12732cb6e44d8300e6b1b20

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
x86_64
git-lfs-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 35df42ac8b1c7231a0a54f67188c652cc270739f7387b61cfa286b73cd6b6d30
git-lfs-debuginfo-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: 50474431882009a4b3bf30aabd7a5b2fb0a0173bd32e8346d1a67442d05567d6
git-lfs-debugsource-3.7.1-4.el9_8.3.x86_64.rpm SHA-256: a5f31cfad482f0cdd16b9f4cb718438bed16879e711bc414a3c2f6681699824a

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
aarch64
git-lfs-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 46fcb6f34490f575b318518eff43154b93f47278dd85b824a045f5997a92e1c8
git-lfs-debuginfo-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: 476092b66015fe131984cd3fa96546c801e4100d580e765c67514b1c1a0cf45a
git-lfs-debugsource-3.7.1-4.el9_8.3.aarch64.rpm SHA-256: e8155467612e4c10cd18a9afe5960684d7a8679083d6a936c03fc3199e7ee894

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
ppc64le
git-lfs-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 14eb3e2046580a216550728d58c75ee4e984c21dddbd66125a233504748837fb
git-lfs-debuginfo-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 7aae55edeb9082564dea434166ab2c19733545c593578a1ef7b3f501b77d7bae
git-lfs-debugsource-3.7.1-4.el9_8.3.ppc64le.rpm SHA-256: 49087e383555d46b344b3454afeeb7c330e2a8a59fa0f95cbb2993268a0f6d6d

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8

SRPM
git-lfs-3.7.1-4.el9_8.3.src.rpm SHA-256: 80a2242c880e45bf2d44048019f3e0cd1c28d28b655a4d53df301459d315ba62
s390x
git-lfs-3.7.1-4.el9_8.3.s390x.rpm SHA-256: c83b117153a1a130c218f82d378e7f02c412927ba37a681974d66048d15576d7
git-lfs-debuginfo-3.7.1-4.el9_8.3.s390x.rpm SHA-256: 1705ff213488e7616d4509c951bbe8720e2b9377a8018ca003bd33ad2a9d98cd
git-lfs-debugsource-3.7.1-4.el9_8.3.s390x.rpm SHA-256: a5dbc4d1578798d412754395d54778e58228b8d1a12732cb6e44d8300e6b1b20

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.