Red Hat Updates Git LFS for Twelve RHEL 9 Vulnerabilities
Tech GuruQuick Answer
RHSA-2026:72276 supplies git-lfs 3.4.1-4.el9_4.6 for RHEL 9.4 Update Services for SAP Solutions. The twelve CVEs include bundled Go dependencies. Update the relevant Git LFS package; changing a separately installed Go toolchain is not evidence that this binary has been rebuilt with the fixes.
Confirm Scope And Apply The Supported Fix
Next step: Inventory Git LFS on developer hosts and build runners, confirm the RHEL 9.4 E4S entitlement, and use its supported repository. Check separately downloaded binaries and container images independently.
Last verified: 2026-09-28 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 9.4 E4S git-lfs packages before 3.4.1-4.el9_4.6 |
|---|---|
| Advisory | RHSA-2026:72276 |
| CVEs | CVE-2025-68121, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-33811, CVE-2026-33818, CVE-2026-39821, CVE-2026-42504, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862 |
| Authoritative release date | RHSA-2026:72276: 2026-09-28 02:09:38 UTC |
| Authority revision date | RHSA-2026:72276: 2026-09-28 03:51:53 UTC |
| Affected versions | Entitled RHEL 9.4 Update Services for SAP Solutions systems with the advisory-listed git-lfs package before 3.4.1-4.el9_4.6; CVE-specific workflows and dependencies vary. |
| Fixed version | git-lfs 3.4.1-4.el9_4.6 |
| CVSS base score | 5.9–8.2 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The advisory combines dependency-level issues with different triggers. Assess the binary and the workflows that use it rather than treating the presence of a Go package as the entire exposure decision. Keep repository credentials and any unexpected object changes out of public diagnostics.
What To Validate Now
- Inventory. Locate RHEL 9.4 E4S git-lfs packages before 3.4.1-4.el9_4.6 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Entitled RHEL 9.4 Update Services for SAP Solutions systems with the advisory-listed git-lfs package before 3.4.1-4.el9_4.6; CVE-specific workflows and dependencies vary. Do not infer applicability from product family or severity alone.
- Remediate. Apply git-lfs 3.4.1-4.el9_4.6 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm which git-lfs executable the shell or runner uses and record its package origin. Test clone, fetch, checkout and an authorized push against a disposable repository with LFS objects. Check authentication, proxy/TLS behavior, and expected object contents.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
