Git-Lfs Security Update — AlmaLinux 9 (ALSA-2026:19350)

Type:

security

Severity:

important

Release date:

2026-10-26

Description:

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

• CVE-2026-25679
• CVE-2026-32280
• CVE-2026-32282
• CVE-2026-32283
• CVE-2024-45341
• CVE-2025-4673
• CVE-2025-47906
• CVE-2026-32281
• CVE-2026-33810
• RHSA-2026:19350
• ALSA-2026:19350

Updated packages listed below:

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.