This Red Hat security advisory for git-lfs addresses several vulnerabilities: CVE-2026-25679 involves incorrect parsing of IPv6 host literals in the net/url package; CVE-2026-32282 concerns a symlink traversal issue in golang's internal/syscall/unix Root.Chmod function; CVE-2026-32283 and CVE-2026-32280 are denial of service vulnerabilities in Go's crypto/tls and crypto/x509 packages related to TLS 1.3 key update messages and certificate chain building, respectively. The update is provided for Red Hat Enterprise Linux 8 on multiple architectures including x86_64, ppc64le, s390x, and aarch64. The advisory references updated git-lfs packages version 3.4.1-10.el8_10 that include these fixes.

The vulnerabilities fixed in this update can lead to denial of service conditions and potential security bypasses due to improper parsing and symlink handling. Specifically, denial of service can be triggered via TLS 1.3 key update messages and certificate chain building. The symlink traversal issue could allow Root.Chmod to affect files outside the intended root directory. These issues impact the stability and security of systems using git-lfs on affected Red Hat Enterprise Linux 8 versions.

Red Hat has released updated git-lfs packages (version 3.4.1-10.el8_10) for Red Hat Enterprise Linux 8 and related distributions that address these vulnerabilities. Users should apply these official updates promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided update.