Loading story…
Red Hat released multiple Important security updates for git-lfs across Red Hat Enterprise Linux 8, 9, and 10 after the package inherited several vulnerabilities from Go components. The advisories cover CVE-2026-32282, a flaw in Go's internal/syscall/unix where Root.Chmod can follow symlinks outside an intended root on Linux, as well as denial-of-service issues in crypto/tls and crypto/x509; some RHEL 8, 9, and 10 channels also include CVE-2026-25679, an incorrect IPv6 host literal parsing bug in net/url. Updated packages were issued for multiple architectures and support streams, including Extended Update Support and Extended Life Cycle variants.
According to Red Hat's bug tracking, CVE-2026-32282 stems from Linux fchmodat behavior that ignores the AT_SYMLINK_NOFOLLOW flag, creating a time-of-check to time-of-use race in which an attacker could swap a checked target for a symlink before chmod executes. Red Hat rated that underlying Go issue Medium severity, but bundled git-lfs fixes were published under advisories including RHSA-2026:16875, RHSA-2026:14200, RHSA-2026:19350, RHSA-2026:19133, RHSA-2026:19715, and RHSA-2026:19722, with updated builds such as git-lfs-3.4.1-10.el8_10, 3.6.1-8.el9_7.1, 3.6.1-2.el9_6.4, 3.7.1-4.el9_8, 3.6.1-2.el10_0.4, and 3.7.1-4.el10_2.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:19722 for git-lfs on Red Hat Enterprise Linux 9.6 channels, shipping version 3.6.1-2.el9_6.4. The update remediated CVE-2026-32282 together with two other Go-related vulnerabilities across several RHEL 9.6 service streams and architectures.
Red Hat published RHSA-2026:19715 for git-lfs in Red Hat Enterprise Linux 10.0 channels, providing git-lfs-3.6.1-2.el10_0.4 packages. The advisory fixed CVE-2026-32282 along with CVE-2026-32283 and CVE-2026-32280 for multiple RHEL 10.0 architectures.
Red Hat published RHSA-2026:19350 for git-lfs on Red Hat Enterprise Linux 9, shipping git-lfs-3.7.1-4.el9_8 packages. This advisory addressed CVE-2026-32282 and three other Go-derived flaws for RHEL 9.8-related product variants.
Red Hat published RHSA-2026:19133 for git-lfs on Red Hat Enterprise Linux 10, releasing git-lfs-3.7.1-4.el10_2 packages. The update fixed CVE-2026-32282 and three additional Go vulnerabilities across multiple RHEL 10 architectures and lifecycle channels.
Red Hat published RHSA-2026:16875 for git-lfs on Red Hat Enterprise Linux 8, providing updated git-lfs-3.4.1-10.el8_10 packages. The advisory remediated CVE-2026-32282 together with three other Go-related vulnerabilities across RHEL 8 and Extended Life Cycle 8.10 variants.
Red Hat published RHSA-2026:14200 for git-lfs on Red Hat Enterprise Linux 9, shipping version 3.6.1-8.el9_7.1. The advisory fixed CVE-2026-32282 along with CVE-2026-32283 and CVE-2026-32280 across multiple RHEL 9 architectures and support channels.
Red Hat recorded bug 2456336 for CVE-2026-32282, a Go Linux vulnerability in internal/syscall/unix where Root.Chmod can follow symlinks out of the intended root in a race condition scenario. The bug was classified with medium severity and medium priority.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories for `containernetworking-plugins`, `skopeo`, and `git-lfs` across RHEL 9 and RHEL 10 channels after upstream Go vulnerabilities exposed those packages to denial-of-service, memory exhaustion, and TLS validation risks. The updates address `CVE-2025-61729` in Go's `crypto/x509`, `CVE-2025-61726` in `net/url` query parsing, and `CVE-2025-68121` in `crypto/tls`; newer `containernetworking-plugins` advisories also include `CVE-2026-25679`, an IPv6 host literal parsing flaw in `net/url`. Affected product streams include RHEL 9, RHEL 9.2 SAP-related channels, RHEL 9.6 EUS and associated service variants, and RHEL 10 update channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. Upstream Go disclosures show the most prominent issue, `CVE-2025-61729`, can drive excessive CPU use during certificate hostname verification through inefficient handling in `crypto/x509`, including repeated hostname splitting and costly string processing in verification paths such as `Certificate.Verify` and `VerifyHostname`. Red Hat shipped fixed builds including `containernetworking-plugins` `1.7.1-3.el9_7`, `1.6.2-3.el9_6`, and `1.2.0-3.el9_2.3`, `skopeo` `1.20.0-3.el10_1`, and `git-lfs` `3.6.1-2.el10_0.2`, and urged customers to apply the updates to reduce exposure in container networking and software supply chain workflows.
Aug 20, 2026
Red Hat released a broad set of **Important** security updates for Go and Go-based packages across **RHEL 8, 9, and 10**, fixing multiple vulnerabilities that include build-time arbitrary code execution, denial of service, memory corruption, certificate validation failures, and a symlink-following flaw. Core `golang` and `go-toolset:rhel8` updates moved affected platforms to fixed Go builds such as **1.25.9** variants, addressing CVEs including `CVE-2026-27140`, `CVE-2026-27143`, `CVE-2026-27144`, `CVE-2026-32280`, `CVE-2026-32282`, and `CVE-2026-32283`. Red Hat said `CVE-2026-27140` could allow **arbitrary code execution during builds** through malicious SWIG filenames containing `cgo`, a flaw it scored **CVSS 9.0**. The fixes also cascaded into Red Hat packages that embed or depend on Go components, including **osbuild-composer**, **go-fdo-client**, **go-fdo-server**, **yggdrasil**, **delve**, **gvisor-tap-vsock**, and **golang-github-openprinting-ipp-usb**. Several advisories specifically remediated Go `crypto/x509` and `crypto/tls` issues tied to certificate chain validation and building (`CVE-2026-32280`, `CVE-2026-32281`, `CVE-2026-32283`), `net/url` parsing flaws such as `CVE-2026-25679`, and the `internal/syscall/unix` `Root.Chmod` symlink issue (`CVE-2026-32282`). Updated packages were published across standard, Extended Update Support, Advanced Update Support, SAP, and Extended Life Cycle channels for x86_64, aarch64, ppc64le, and s390x systems.
Aug 20, 2026
Red Hat released multiple **Important** security advisories to patch Go-related vulnerabilities across several Red Hat Enterprise Linux products, including `gvisor-tap-vsock`, `git-lfs`, `rhc`, HawtIO in the Red Hat build of Apache Camel, and the `container-tools:rhel8` module. The updates primarily address **CVE-2025-61729**, a denial-of-service flaw in Go's `crypto/x509` package that can be triggered by a crafted certificate during hostname verification, and **CVE-2025-61726**, a memory exhaustion issue in Go `net/url` query parsing. Some advisories also include fixes for **CVE-2026-25679** in `net/url`, **CVE-2024-24785** in `html/template`, and **CVE-2025-65637** in `logrus`. The underlying Go flaw tracked as **GO-2025-4155** affects `HostnameError.Error()` in `crypto/x509`, where unbounded hostname printing and repeated string concatenation can cause quadratic runtime and excessive resource consumption. Go maintainers fixed the issue in **Go 1.24.11** and **Go 1.25.5** by limiting printed hosts and replacing repeated concatenation with `strings.Builder`, and Red Hat has now shipped corresponding package updates across affected RHEL 8 and RHEL 9 channels and architectures, including updated builds such as `gvisor-tap-vsock 0.7.3-5.el9_4.3`, `git-lfs 2.13.3-3.el8_4.4`, and `rhc 0.2.1-12.el9_0`.
Aug 20, 2026