Vulnerability-Lookup

OPENSUSE-SU-2026:21621-1

Vulnerability from csaf_opensuse - Published: 2026-08-21 15:09 - Updated: 2026-08-21 15:09

Summary

Security update for git-lfs

Severity

Important

Notes

Title of the patch: Security update for git-lfs

Description of the patch: This update for git-lfs fixes the following issues: Changes in git-lfs: - update to 3.7.1: (boo#1252259 CVE-2025-26625) This release introduces security fixes for Linux, macOS, and Windows systems, which have been collectively assigned CVE-2025-26625. When populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. Git LFS has resolved this problem by revising the git lfs checkout and git lfs pull commands so that they check for symbolic links in the same manner as performed by Git before writing to files in the working tree. These commands now also remove existing files in the working tree before writing new files in their place. As well, Git LFS has resolved a problem whereby the git lfs checkout and git lfs pull commands, when run in a bare repository, could write to files visible outside the repository. While a specific and relatively unlikely set of conditions were required for this to occur, it is no longer possible under any circumstances. We would like to extend a special thanks to the following open-source contributors: Apple Product Security for reporting this to us responsibly * Bugs - Detect symbolic links on checkout and pull (@chrisd8088) * Misc - Upgrade to Go 1.25 (@chrisd8088) - update to 3.7.0 This release is a feature release which introduces several new options for fetching Git LFS objects, such as the ability to force objects to be re-downloaded and the capacity to output object URLs and HTTP metadata in JSON for external tools to consume. This release also adds a configurable in-memory cache of file path pattern matches, which along with other changes can help reduce the time required to migrate large repositories to Git LFS. Git LFS now supports the same .netrc files on Windows as Git and curl, retries appropriately after all 429 status code HTTP responses, permits the use of symbolic links to Git's object storage during Git LFS migrations - Features - Cache a file path filter match result #6047 (@alexkad0) - Add --refetch option to fetch #5975 (@redsun82) - Add --json option to fetch #5974 (@redsun82) - Add --dry-run option to fetch #5973 (@redsun82) - Bugs - Verify TLS/SSL certificates using default Go support for macOS system root CAs #6049 (@chrisd8088) - Prefer .netrc on windows if present #6055 (@johanvdw) - Fix migrations where .git/objects is a symlink #6042 (@bk2204) - Honour 429 object transfer response Retry-After headers #6014 (@chrisd8088) - Misc - Update Linux distribution package list for v3.7.0 release (@chrisd8088) - Report missing objects consistently when pushing #6027 (@chrisd8088) - Use a git-update-ref script to update references #6048 (@alexkad0) - Drop unused generic stub function for cloning files #6050 (@chrisd8088) - Prevent conflicting curl macros in early Git version CI jobs #6040 (@chrisd8088) - pull: improve error message on failing checkout #5629 (@bk2204) - Fix language in code snippets in API docs #6035 (@slonopotamus) - build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 #6034 (@dependabot[bot]) - Use single-target Makefile patterns for manual pages #6032 (@chrisd8088) - use direct value nil for error #6024 (@alingse) - Update minimum required Git version checks #6028 (@chrisd8088) - build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 #6012 (@dependabot[bot]) - Upgrading x/crypto to v0.35.0 to solve CVE-2025-22869 bsc#1239322 #5997 (@gergelyfabian) - Upgrade to Go 1.24 #6013 (@chrisd8088) - Use constant format strings and fix HTTP error messages #5998 (@chrisd8088) - Remove command name prefixes from progress messages #5995 (@chrisd8088) - doc: Add missing "--to" argument in git-lfs-checkout example #6005 (@DarkDefender) - Replace min/max helpers with built-in min/max #5999 (@Juneezee) - Add security patch release process documentation #5987 (@chrisd8088) - Replace unused debug mode with trace logging #5989 (@chrisd8088) - Use default Ruby provided by Actions runners #5984 (@chrisd8088) - build(deps): bump azure/trusted-signing-action from 0.5.0 to 0.5.1 #5981 (@dependabot[bot]) - Update workflows to use ARM runners and new Apple signing certificate #5977 (@chrisd8088) - docs/man/git-lfs-prune.adoc: fix --(no-)verify-unreachable description #5959 (@m3ka24) - docs/man/git-lfs-migrate.adoc: remove duplicate flag #5944 (@fedirz) - Upgrade golang.org/x/net from 0.23.0 to 0.33.0 #5940 (@gergelyfabian) - build(deps): bump golang.org/x/crypto from 0.21.0 to 0.31.0 #5935 (@dependabot[bot]) - Simplify macOS CI jobs and specify Go toolchain version #5931 (@chrisd8088) - Tighten security of Actions workflows #5930 (@bk2204) - Corrected Pop!_OS naming #5929 (@LucasDondo) - Update release process documentation and scripts #5920 (@chrisd8088) - Update license copyright dates and minimum supported Git version #5921 (@chrisd8088)

Patchnames: openSUSE-Leap-16.0-packagehub-522

CVE-2025-22869

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2025-26625

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64	—	Vendor Fix

Threats

Impact important

References

10 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1239322	self
https://bugzilla.suse.com/1252259	self
https://www.suse.com/security/cve/CVE-2025-22869/	self
https://www.suse.com/security/cve/CVE-2025-26625/	self
https://www.suse.com/security/cve/CVE-2025-22869	external
https://bugzilla.suse.com/1239322	external
https://www.suse.com/security/cve/CVE-2025-26625	external
https://bugzilla.suse.com/1252259	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for git-lfs",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for git-lfs fixes the following issues:\n\nChanges in git-lfs:\n\n- update to 3.7.1: (boo#1252259 CVE-2025-26625)\n\n  This release introduces security fixes for Linux, macOS, and\n  Windows systems, which have been collectively assigned\n  CVE-2025-26625.\n\n  When populating a Git repository\u0027s working tree with the contents\n  of Git LFS objects, certain Git LFS commands may write to files\n  visible outside the current Git working tree if symbolic or hard\n  links exist which collide with the paths of files tracked by Git\n  LFS.\n\n  Git LFS has resolved this problem by revising the git lfs\n  checkout and git lfs pull commands so that they check for\n  symbolic links in the same manner as performed by Git before\n  writing to files in the working tree.  These commands now also\n  remove existing files in the working tree before writing new\n  files in their place.\n\n  As well, Git LFS has resolved a problem whereby the git lfs\n  checkout and git lfs pull commands, when run in a bare\n  repository, could write to files visible outside the repository.\n  While a specific and relatively unlikely set of conditions were\n  required for this to occur, it is no longer possible under any\n  circumstances.\n\n  We would like to extend a special thanks to the following\n  open-source contributors:\n    Apple Product Security for reporting this to us responsibly\n\n  * Bugs\n    - Detect symbolic links on checkout and pull (@chrisd8088)\n  * Misc\n    - Upgrade to Go 1.25 (@chrisd8088)\n\n- update to 3.7.0\n\n  This release is a feature release which introduces several new options\n  for fetching Git LFS objects, such as the ability to force objects\n  to be re-downloaded and the capacity to output object URLs and HTTP\n  metadata in JSON for external tools to consume. This release also\n  adds a configurable in-memory cache of file path pattern matches,\n  which along with other changes can help reduce the time required to\n  migrate large repositories to Git LFS.\n\n  Git LFS now supports the same .netrc files on Windows as Git and\n  curl, retries appropriately after all 429 status code HTTP\n  responses, permits the use of symbolic links to Git\u0027s object\n  storage during Git LFS migrations\n\n  - Features\n    - Cache a file path filter match result #6047 (@alexkad0)\n    - Add --refetch option to fetch #5975 (@redsun82)\n    - Add --json option to fetch #5974 (@redsun82)\n    - Add --dry-run option to fetch #5973 (@redsun82)\n  - Bugs\n    - Verify TLS/SSL certificates using default Go support for\n      macOS system root CAs #6049 (@chrisd8088)\n    - Prefer .netrc on windows if present #6055 (@johanvdw)\n    - Fix migrations where .git/objects is a symlink #6042\n      (@bk2204)\n    - Honour 429 object transfer response Retry-After headers #6014\n      (@chrisd8088)\n  - Misc\n    - Update Linux distribution package list for v3.7.0 release\n      (@chrisd8088)\n    - Report missing objects consistently when pushing #6027\n      (@chrisd8088)\n    - Use a git-update-ref script to update references #6048\n      (@alexkad0)\n    - Drop unused generic stub function for cloning files #6050\n      (@chrisd8088)\n    - Prevent conflicting curl macros in early Git version CI jobs\n      #6040 (@chrisd8088)\n    - pull: improve error message on failing checkout #5629\n      (@bk2204)\n    - Fix language in code snippets in API docs #6035\n      (@slonopotamus)\n    - build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0\n      #6034 (@dependabot[bot])\n    - Use single-target Makefile patterns for manual pages #6032\n      (@chrisd8088)\n    - use direct value nil for error #6024 (@alingse)\n    - Update minimum required Git version checks #6028\n      (@chrisd8088)\n    - build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0\n      #6012 (@dependabot[bot])\n    - Upgrading x/crypto to v0.35.0 to solve CVE-2025-22869 bsc#1239322\n      #5997 (@gergelyfabian)\n    - Upgrade to Go 1.24 #6013 (@chrisd8088)\n    - Use constant format strings and fix HTTP error messages #5998\n      (@chrisd8088)\n    - Remove command name prefixes from progress messages #5995\n      (@chrisd8088)\n    - doc: Add missing \"--to\" argument in git-lfs-checkout example\n      #6005 (@DarkDefender)\n    - Replace min/max helpers with built-in min/max #5999\n      (@Juneezee)\n    - Add security patch release process documentation #5987\n      (@chrisd8088)\n    - Replace unused debug mode with trace logging #5989\n      (@chrisd8088)\n    - Use default Ruby provided by Actions runners #5984\n      (@chrisd8088)\n    - build(deps): bump azure/trusted-signing-action from 0.5.0 to\n      0.5.1 #5981 (@dependabot[bot])\n    - Update workflows to use ARM runners and new Apple signing\n      certificate #5977 (@chrisd8088)\n    - docs/man/git-lfs-prune.adoc: fix --(no-)verify-unreachable\n      description #5959 (@m3ka24)\n    - docs/man/git-lfs-migrate.adoc: remove duplicate flag #5944\n      (@fedirz)\n    - Upgrade golang.org/x/net from 0.23.0 to 0.33.0 #5940\n      (@gergelyfabian)\n    - build(deps): bump golang.org/x/crypto from 0.21.0 to 0.31.0\n      #5935 (@dependabot[bot])\n    - Simplify macOS CI jobs and specify Go toolchain version #5931\n      (@chrisd8088)\n    - Tighten security of Actions workflows #5930 (@bk2204)\n    - Corrected Pop!_OS naming #5929 (@LucasDondo)\n    - Update release process documentation and scripts #5920\n      (@chrisd8088)\n    - Update license copyright dates and minimum supported Git\n      version #5921 (@chrisd8088)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-522",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21621-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1239322",
        "url": "https://bugzilla.suse.com/1239322"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1252259",
        "url": "https://bugzilla.suse.com/1252259"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22869 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-26625 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-26625/"
      }
    ],
    "title": "Security update for git-lfs",
    "tracking": {
      "current_release_date": "2026-08-21T15:09:38Z",
      "generator": {
        "date": "2026-08-21T15:09:38Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21621-1",
      "initial_release_date": "2026-08-21T15:09:38Z",
      "revision_history": [
        {
          "date": "2026-08-21T15:09:38Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-3.7.1-bp160.1.1.aarch64",
                "product": {
                  "name": "git-lfs-3.7.1-bp160.1.1.aarch64",
                  "product_id": "git-lfs-3.7.1-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-3.7.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "git-lfs-3.7.1-bp160.1.1.ppc64le",
                  "product_id": "git-lfs-3.7.1-bp160.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-3.7.1-bp160.1.1.s390x",
                "product": {
                  "name": "git-lfs-3.7.1-bp160.1.1.s390x",
                  "product_id": "git-lfs-3.7.1-bp160.1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "git-lfs-3.7.1-bp160.1.1.x86_64",
                "product": {
                  "name": "git-lfs-3.7.1-bp160.1.1.x86_64",
                  "product_id": "git-lfs-3.7.1-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-3.7.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64"
        },
        "product_reference": "git-lfs-3.7.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-3.7.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le"
        },
        "product_reference": "git-lfs-3.7.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-3.7.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x"
        },
        "product_reference": "git-lfs-3.7.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "git-lfs-3.7.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
        },
        "product_reference": "git-lfs-3.7.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22869",
          "url": "https://www.suse.com/security/cve/CVE-2025-22869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239322 for CVE-2025-22869",
          "url": "https://bugzilla.suse.com/1239322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-21T15:09:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22869"
    },
    {
      "cve": "CVE-2025-26625",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-26625"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository\u0027s working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-26625",
          "url": "https://www.suse.com/security/cve/CVE-2025-26625"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1252259 for CVE-2025-26625",
          "url": "https://bugzilla.suse.com/1252259"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:git-lfs-3.7.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-21T15:09:38Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-26625"
    }
  ]
}

CVE-2025-22869 (GCVE-0-2025-22869)

Vulnerability from cvelistv5 – Published: 2025-02-26 03:07 – Updated: 2025-04-11 22:03

Title

Potential denial of service in golang.org/x/crypto

Summary

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-26 14:57 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/652135
https://go.dev/issue/71931
https://pkg.go.dev/vuln/GO-2025-3487
https://security.netapp.com/advisory/ntap-2025041…

Impacted products

1 product

Vendor	Product	Version
golang.org/x/crypto	golang.org/x/crypto/ssh	Affected: 0 , < 0.35.0 (semver)

Credits

Yuichi Watanabe

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T14:57:07.968721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-26T14:57:49.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-04-11T22:03:24.222Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250411-0010/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "newHandshakeTransport"
            },
            {
              "name": "handshakeTransport.recordWriteError"
            },
            {
              "name": "handshakeTransport.kexLoop"
            },
            {
              "name": "handshakeTransport.writePacket"
            },
            {
              "name": "Client.Dial"
            },
            {
              "name": "Client.DialContext"
            },
            {
              "name": "Client.DialTCP"
            },
            {
              "name": "Client.Listen"
            },
            {
              "name": "Client.ListenTCP"
            },
            {
              "name": "Client.ListenUnix"
            },
            {
              "name": "Client.NewSession"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DiscardRequests"
            },
            {
              "name": "NewClient"
            },
            {
              "name": "NewClientConn"
            },
            {
              "name": "NewServerConn"
            },
            {
              "name": "Request.Reply"
            },
            {
              "name": "Session.Close"
            },
            {
              "name": "Session.CombinedOutput"
            },
            {
              "name": "Session.Output"
            },
            {
              "name": "Session.RequestPty"
            },
            {
              "name": "Session.RequestSubsystem"
            },
            {
              "name": "Session.Run"
            },
            {
              "name": "Session.SendRequest"
            },
            {
              "name": "Session.Setenv"
            },
            {
              "name": "Session.Shell"
            },
            {
              "name": "Session.Signal"
            },
            {
              "name": "Session.Start"
            },
            {
              "name": "Session.WindowChange"
            },
            {
              "name": "channel.Accept"
            },
            {
              "name": "channel.Close"
            },
            {
              "name": "channel.CloseWrite"
            },
            {
              "name": "channel.Read"
            },
            {
              "name": "channel.ReadExtended"
            },
            {
              "name": "channel.Reject"
            },
            {
              "name": "channel.SendRequest"
            },
            {
              "name": "channel.Write"
            },
            {
              "name": "channel.WriteExtended"
            },
            {
              "name": "connection.SendAuthBanner"
            },
            {
              "name": "curve25519sha256.Client"
            },
            {
              "name": "curve25519sha256.Server"
            },
            {
              "name": "dhGEXSHA.Client"
            },
            {
              "name": "dhGEXSHA.Server"
            },
            {
              "name": "dhGroup.Client"
            },
            {
              "name": "dhGroup.Server"
            },
            {
              "name": "ecdh.Client"
            },
            {
              "name": "ecdh.Server"
            },
            {
              "name": "extChannel.Read"
            },
            {
              "name": "extChannel.Write"
            },
            {
              "name": "mux.OpenChannel"
            },
            {
              "name": "mux.SendRequest"
            },
            {
              "name": "sessionStdin.Close"
            },
            {
              "name": "sshClientKeyboardInteractive.Challenge"
            },
            {
              "name": "tcpListener.Accept"
            },
            {
              "name": "tcpListener.Close"
            },
            {
              "name": "unixListener.Accept"
            },
            {
              "name": "unixListener.Close"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.35.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yuichi Watanabe"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-26T03:07:48.855Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/652135"
        },
        {
          "url": "https://go.dev/issue/71931"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3487"
        }
      ],
      "title": "Potential denial of service in golang.org/x/crypto"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-22869",
    "datePublished": "2025-02-26T03:07:48.855Z",
    "dateReserved": "2025-01-08T19:11:42.834Z",
    "dateUpdated": "2025-04-11T22:03:24.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-26625 (GCVE-0-2025-26625)

Vulnerability from cvelistv5 – Published: 2025-10-17 15:30 – Updated: 2026-05-31 15:29

Title

Git LFS may write to arbitrary files via crafted symlinks

Summary

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-17 15:44 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/git-lfs/git-lfs/security/advis…	x_refsource_CONFIRM
https://github.com/git-lfs/git-lfs/commit/0cffe93…	x_refsource_MISC
https://github.com/git-lfs/git-lfs/commit/5c11ffc…	x_refsource_MISC
https://github.com/git-lfs/git-lfs/commit/d02bd13…	x_refsource_MISC
https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
git-lfs	git-lfs	Affected: >= 0.5.2, < 3.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26625",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-17T15:44:04.948544Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-17T15:44:38.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-31T15:29:06.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00055.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "git-lfs",
          "vendor": "git-lfs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.5.2, \u003c 3.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository\u0027s working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-17T15:30:14.630Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5"
        },
        {
          "name": "https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396"
        },
        {
          "name": "https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8"
        },
        {
          "name": "https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615"
        },
        {
          "name": "https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1"
        }
      ],
      "source": {
        "advisory": "GHSA-6pvw-g552-53c5",
        "discovery": "UNKNOWN"
      },
      "title": "Git LFS may write to arbitrary files via crafted symlinks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-26625",
    "datePublished": "2025-10-17T15:30:14.630Z",
    "dateReserved": "2025-02-12T14:51:02.719Z",
    "dateUpdated": "2026-05-31T15:29:06.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

OPENSUSE-SU-2026:21621-1

CVE-2025-22869 (GCVE-0-2025-22869)

CVE-2025-26625 (GCVE-0-2025-26625)

Tags

Sightings

Nomenclature