What is RHSA-2026:67161?

RHSA-2026:67161 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: git-lfs security update

Which CVE IDs does RHSA-2026:67161 cover?

RHSA-2026:67161 covers the following CVE IDs: CVE-2026-33818, CVE-2026-56860, CVE-2026-56862. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2026:67161?

RHSA-2026:67161 has a CVSS v3 base score of 7.5, published by Red Hat Product Security.

Which products are affected by RHSA-2026:67161?

RHSA-2026:67161 affects 14 products, including: Red Hat Enterprise Linux AppStream (v. 8); git-lfs-0:3.4.1-13.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8); git-lfs-0:3.4.1-13.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8); git-lfs-0:3.4.1-13.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8); git-lfs-0:3.4.1-13.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8); and others — see the full list on the advisory page.

RHSA-2026:67161HighCVSS 7.5

Red Hat Security Advisory: git-lfs security update

Vendor

Red Hat Product Security

Published

September 14, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (3)

CVE-2026-33818 →CVE-2026-56860 →CVE-2026-56862 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products14

Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-0:3.4.1-13.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-0:3.4.1-13.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-0:3.4.1-13.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-0:3.4.1-13.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-0:3.4.1-13.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debuginfo-0:3.4.1-13.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debuginfo-0:3.4.1-13.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debuginfo-0:3.4.1-13.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debuginfo-0:3.4.1-13.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debugsource-0:3.4.1-13.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debugsource-0:3.4.1-13.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debugsource-0:3.4.1-13.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
git-lfs-debugsource-0:3.4.1-13.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 CVE IDs covered (3)

📋 Description

🎯 Affected products14

✅ Remediation

🔗 References (6)