[CLSA-2026:1792667094] git-lfs: Fix of CVE-2026-39821
Type:
security
Severity:
Important
Release date:
2026-10-22 11:05:05 UTC
Description:
- CVE-2026-39821: reject xn-- labels that decode to all-ASCII in the vendored golang.org/x/net/idna package; the vendor fix is inert when built with Go 1.26
CVEs fixed:
Updated packages:
  • git-lfs-3.7.1-4.el9_8.3.tuxcare.els1.aarch64.rpm
    sha:ab7878cac792d95665ffbc7461080640ec885377a5db36d271bd5a031eb3a9de
  • git-lfs-3.7.1-4.el9_8.3.tuxcare.els1.x86_64.rpm
    sha:58db425771f03fb348d3d28fe0bd0dc7e678dac750f0aea6c1f0d6519422aa08
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.