This advisory covers security fixes for git-lfs on Red Hat Enterprise Linux 9, addressing three vulnerabilities in Go components used by git-lfs. CVE-2026-32282 involves a flaw in internal/syscall/unix where Root.Chmod can follow symlinks outside the intended root directory, potentially leading to unauthorized file permission changes. CVE-2026-32283 is a denial of service vulnerability triggered by multiple TLS 1.3 key update messages in the crypto/tls package. CVE-2026-32280 is a denial of service vulnerability in certificate chain building within crypto/x509. These issues collectively could allow denial of service conditions and unintended file system modifications. The advisory references Red Hat's errata RHSA-2026:14200 and provides updated git-lfs packages to remediate these vulnerabilities.

The vulnerabilities addressed can lead to denial of service conditions affecting git-lfs operations and potentially unauthorized changes to file permissions due to symlink traversal. Specifically, the Root.Chmod symlink issue could allow privilege escalation or unauthorized file modifications. The TLS-related vulnerabilities could disrupt secure communications by causing denial of service during TLS 1.3 key updates or certificate chain validation. No known exploits in the wild have been reported at this time. The overall impact is rated as high by Red Hat Product Security.

Red Hat has released updated git-lfs packages (version 3.6.1-8.el9_7.1) for Red Hat Enterprise Linux 9 and related variants to address these vulnerabilities. Users should apply the official security update as detailed in Red Hat advisory RHSA-2026:14200. For instructions on applying the update, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patch.