Red Hat Product Errata RHSA-2026:67149 - Security Advisory Issued: 2026-09-14 Updated: 2026-09-14 RHSA-2026:67149 - Security Advisory Overview Updated Packages Synopsis Important: git-lfs security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for git-lfs is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) golang.org/x/net/idna: golang: net/ http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2456333 - CVE-2026-32281 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation BZ - 2456335 - CVE-2026-33810 crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing BZ - 2515815 - CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal BZ - 2515820 - CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution BZ - 2515839 - CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVEs CVE-2026-32281 CVE-2026-33810 CVE-2026-33811 CVE-2026-33818 CVE-2026-39821 CVE-2026-56860 CVE-2026-56862 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 x86_64 git-lfs-3.6.1-2.el10_0.7.x86_64.rpm SHA-256: fe84f44a77a9ed8773fbe9330ea01998c34aa959f07ef5defc966551be669526 git-lfs-debuginfo-3.6.1-2.el10_0.7.x86_64.rpm SHA-256: 0135cb82e801190d1087dea90c667ed75d16f77b8e1e693c6141f7fb2b5af173 git-lfs-debugsource-3.6.1-2.el10_0.7.x86_64.rpm SHA-256: 8bec8ba1559f79185590986bd3278b24876199fb4e023e5ee596bda3beee0f00 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 s390x git-lfs-3.6.1-2.el10_0.7.s390x.rpm SHA-256: c455f9a4655544c07c630826fd14046c1125090b241b693405de154beac67c19 git-lfs-debuginfo-3.6.1-2.el10_0.7.s390x.rpm SHA-256: 0a75ff3d9d9470b931424024f0d5daf106ef7098e5d8ccf1c06173b05abfb326 git-lfs-debugsource-3.6.1-2.el10_0.7.s390x.rpm SHA-256: 1621bf4d0eb17f1c903a72aaebc76b16d1dd417f25dda9fd8be7d902f101bb74 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 ppc64le git-lfs-3.6.1-2.el10_0.7.ppc64le.rpm SHA-256: c5ef060fea3a0602f6ecd20bc0b0a8ab3d239ce1e0921d6734b309a313f2c378 git-lfs-debuginfo-3.6.1-2.el10_0.7.ppc64le.rpm SHA-256: afb4159f4ca506a24d0b3a200ef53683b9b40a10a59551b7aa70b515475b542a git-lfs-debugsource-3.6.1-2.el10_0.7.ppc64le.rpm SHA-256: 2f88c5cf9209b0a4c74a21eba7fd14400e278906908aed67299d70d64e943300 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 aarch64 git-lfs-3.6.1-2.el10_0.7.aarch64.rpm SHA-256: 14ea5b09abb6f55befb8ab41f1b97b1899efea1417fdff5c12cca626b44633d0 git-lfs-debuginfo-3.6.1-2.el10_0.7.aarch64.rpm SHA-256: f0a785828f532a87410e1a033a3687c021693270135d5078ed594ba82e031e85 git-lfs-debugsource-3.6.1-2.el10_0.7.aarch64.rpm SHA-256: 2ede5217b65c9385437d3d591389d801fff906dd3293961b987eec49269dab2c Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 aarch64 git-lfs-3.6.1-2.el10_0.7.aarch64.rpm SHA-256: 14ea5b09abb6f55befb8ab41f1b97b1899efea1417fdff5c12cca626b44633d0 git-lfs-debuginfo-3.6.1-2.el10_0.7.aarch64.rpm SHA-256: f0a785828f532a87410e1a033a3687c021693270135d5078ed594ba82e031e85 git-lfs-debugsource-3.6.1-2.el10_0.7.aarch64.rpm SHA-256: 2ede5217b65c9385437d3d591389d801fff906dd3293961b987eec49269dab2c Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 s390x git-lfs-3.6.1-2.el10_0.7.s390x.rpm SHA-256: c455f9a4655544c07c630826fd14046c1125090b241b693405de154beac67c19 git-lfs-debuginfo-3.6.1-2.el10_0.7.s390x.rpm SHA-256: 0a75ff3d9d9470b931424024f0d5daf106ef7098e5d8ccf1c06173b05abfb326 git-lfs-debugsource-3.6.1-2.el10_0.7.s390x.rpm SHA-256: 1621bf4d0eb17f1c903a72aaebc76b16d1dd417f25dda9fd8be7d902f101bb74 Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 ppc64le git-lfs-3.6.1-2.el10_0.7.ppc64le.rpm SHA-256: c5ef060fea3a0602f6ecd20bc0b0a8ab3d239ce1e0921d6734b309a313f2c378 git-lfs-debuginfo-3.6.1-2.el10_0.7.ppc64le.rpm SHA-256: afb4159f4ca506a24d0b3a200ef53683b9b40a10a59551b7aa70b515475b542a git-lfs-debugsource-3.6.1-2.el10_0.7.ppc64le.rpm SHA-256: 2f88c5cf9209b0a4c74a21eba7fd14400e278906908aed67299d70d64e943300 Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 SRPM git-lfs-3.6.1-2.el10_0.7.src.rpm SHA-256: 98aad13166b5431fa15647e946af9c4ea527a1fd05ea19ffc29da3aaf14120a9 x86_64 git-lfs-3.6.1-2.el10_0.7.x86_64.rpm SHA-256: fe84f44a77a9ed8773fbe9330ea01998c34aa959f07ef5defc966551be669526 git-lfs-debuginfo-3.6.1-2.el10_0.7.x86_64.rpm SHA-256: 0135cb82e801190d1087dea90c667ed75d16f77b8e1e693c6141f7fb2b5af173 git-lfs-debugsource-3.6.1-2.el10_0.7.x86_64.rpm SHA-256: 8bec8ba1559f79185590986bd3278b24876199fb4e023e5ee596bda3beee0f00 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .