Git Large File Storage (git-lfs) for Red Hat Enterprise Linux 9 contains multiple security vulnerabilities stemming from underlying Go language libraries. CVE-2026-32282 involves the internal syscall/unix package where Root.Chmod can follow symlinks outside the intended root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in the crypto/tls and crypto/x509 packages, triggered by multiple TLS 1.3 key update messages and certificate chain building respectively. Red Hat has issued a security update (RHSA-2026:14200) that includes patched git-lfs packages addressing these issues across multiple architectures.

The vulnerabilities could allow an attacker to cause denial of service conditions in applications using the affected Go crypto libraries, potentially disrupting TLS communications. The symlink traversal issue could lead to unauthorized changes to file permissions outside the intended directory root, which may be leveraged for privilege escalation or unauthorized file manipulation. No known exploits are reported in the wild at this time.

Red Hat has released updated git-lfs packages for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply the security update described in advisory RHSA-2026:14200 promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.