# CVE-2024-45341: git-lfs: Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text poi...

CVE-2024-45341 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2024-45341, released January 28, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-45341
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0056
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 17, 2025

## Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  Security Fix(es):  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | delve RHEL 10 | 1.24.1-1.el10_0 | [RHSA-2025:7466](https://patchblox.com/security/data/fix/linux/rhsa-2025-7466.md) | Feb 6, 2025 |
| Linux | delve RHEL 8 | 0:1.24.1-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | delve RHEL 9 | 0:1.24.1-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | delve almalinux 10 | 1.24.1-1.el10_0 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | delve almalinux 8 | 1.24.1-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | delve ol 10 | 0:1.24.1-1.0.1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | delve ol 8 | 0:1.24.1-1.0.1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | delve rocky 10 | 0:1.24.1-1.el10_0 | [RLSA-2025:7466](https://patchblox.com/security/data/fix/linux/rlsa-2025-7466.md) | Oct 3, 2025 |
| Linux | delve rocky 8 | 0:1.24.1-1.module+el8.10.0+1951+c74bd827 | [RLSA-2025:3772](https://patchblox.com/security/data/fix/linux/rlsa-2025-3772.md) | Jul 29, 2025 |
| Linux | delve rocky 9 | 0:1.24.1-2.el9_6 | [RLSA-2025:3773](https://patchblox.com/security/data/fix/linux/rlsa-2025-3773.md) | Jul 29, 2025 |
| Linux | git-lfs RHEL 9 | 0:3.7.1-4.el9_8 | [RHSA-2026:19350](https://patchblox.com/security/data/fix/linux/rhsa-2026-19350.md) | May 15, 2026 |
| Linux | git-lfs almalinux 9 | 3.7.1-4.el9_8 | [ALSA-2026:19350](https://patchblox.com/security/data/fix/linux/alsa-2026-19350.md) | May 19, 2026 |
| Linux | go-toolset RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | go-toolset RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | go-toolset almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | go-toolset almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | go-toolset ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | go-toolset ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | go-toolset rocky 8 | 0:1.23.6-1.module+el8.10.0+1951+c74bd827 | [RLSA-2025:3772](https://patchblox.com/security/data/fix/linux/rlsa-2025-3772.md) | Jul 29, 2025 |
| Linux | go1.22 opensuse-leap 15.6 | 1.22.11-150000.1.39.1 | [SUSE-SU-2025:0281-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0281-1.md) | Jan 29, 2025 |
| Linux | go1.22 sles 15.6 | 1.22.11-150000.1.39.1 | [SUSE-SU-2025:0281-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0281-1.md) | Jan 29, 2025 |
| Linux | go1.23 opensuse-leap 15.6 | 1.23.5-150000.1.18.1 | [SUSE-SU-2025:0280-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0280-1.md) | Jan 29, 2025 |
| Linux | go1.23 sles 15.6 | 1.23.5-150000.1.18.1 | [SUSE-SU-2025:0280-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0280-1.md) | Jan 29, 2025 |
| Linux | go1.23-openssl opensuse-leap 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.7 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.24 opensuse-leap 15.6 | 1.24rc2-150000.1.3.1 | [SUSE-SU-2025:0285-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0285-1.md) | Jan 29, 2025 |
| Linux | go1.24 sles 15.6 | 1.24rc2-150000.1.3.1 | [SUSE-SU-2025:0285-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0285-1.md) | Jan 29, 2025 |
| Linux | golang RHEL 10 | 1.23.7-1.el10_0 | [RHSA-2025:7466](https://patchblox.com/security/data/fix/linux/rhsa-2025-7466.md) | Feb 6, 2025 |
| Linux | golang RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang rocky 10 | 0:1.23.7-1.el10_0 | [RLSA-2025:7466](https://patchblox.com/security/data/fix/linux/rlsa-2025-7466.md) | Oct 3, 2025 |
| Linux | golang rocky 8 | 0:1.23.6-1.module+el8.10.0+1951+c74bd827 | [RLSA-2025:3772](https://patchblox.com/security/data/fix/linux/rlsa-2025-3772.md) | Jul 29, 2025 |
| Linux | golang rocky 9 | 0:1.23.6-2.el9_6 | [RLSA-2025:3773](https://patchblox.com/security/data/fix/linux/rlsa-2025-3773.md) | Jul 29, 2025 |
| Linux | golang-1.22 Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22 Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22 Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.22-go Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22-go 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-go-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22-go Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22-go 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-go-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22-go Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22-go 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-go-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.22-src Ubuntu 22.04.1 LTS (jammy) | 1.22.2-2~22.04.3 | [golang-1.22-src 1.22.2-2~22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.22-src-1.22.2-2-22.04.3.md) | Jun 11, 2025 |
| Linux | golang-1.22-src Ubuntu 24.04.5 LTS (noble) | 1.22.2-2ubuntu0.4 | [golang-1.22-src 1.22.2-2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-golang-1.22-src-1.22.2-2ubuntu0.4.md) | Jun 11, 2025 |
| Linux | golang-1.22-src Ubuntu 24.10 (oracular) | 1.22.8-1ubuntu0.1 | [golang-1.22-src 1.22.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-golang-1.22-src-1.22.8-1ubuntu0.1.md) | Jan 16, 2026 |
| Linux | golang-1.24 Debian 13.5 (trixie) | 1.24~rc2-1 | [DEBIAN-CVE-2024-45341](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45341.md) | Jan 28, 2025 |
| Linux | golang-bin RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-bin RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-bin almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-bin almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-bin amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang-bin ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-bin ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-docs RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-docs RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-docs almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-docs almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-docs amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang-docs ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-docs ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-misc RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-misc RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-misc almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-misc almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-misc amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang-misc ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-misc ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-race RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-shared amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang-src RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-src RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-src almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-src almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-src amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang-src ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-src ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-tests RHEL 8 | 0:1.23.6-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:3772](https://patchblox.com/security/data/fix/linux/rhsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-tests RHEL 9 | 0:1.23.6-2.el9_5 | [RHSA-2025:3773](https://patchblox.com/security/data/fix/linux/rhsa-2025-3773.md) | Apr 10, 2025 |
| Linux | golang-tests almalinux 10 | 1.23.7-1.el10_0.alma.1 | [ALSA-2025:7466](https://patchblox.com/security/data/fix/linux/alsa-2025-7466.md) | May 13, 2025 |
| Linux | golang-tests almalinux 8 | 1.23.6-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:3772](https://patchblox.com/security/data/fix/linux/alsa-2025-3772.md) | Apr 10, 2025 |
| Linux | golang-tests amzn 2023 | 1.24.0-1.amzn2023.0.1 | [ALAS2023-2025-878](https://patchblox.com/security/data/fix/linux/alas2023-2025-878.md) | Feb 26, 2025 |
| Linux | golang-tests ol 10 | 0:1.23.7-1.el10_0 | [ELSA-2025-7466](https://patchblox.com/security/data/fix/linux/elsa-2025-7466.md) | Jun 27, 2025 |
| Linux | golang-tests ol 8 | 0:1.23.6-1.module+el8.10.0+90545+447bd9e4 | [ELSA-2025-3772](https://patchblox.com/security/data/fix/linux/elsa-2025-3772.md) | Apr 10, 2025 |
| Linux | govulncheck-vulndb opensuse-leap 15.6 | 0.0.20250207T224745-150000.1.32.1 | [SUSE-SU-2025:0429-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0429-1.md) | Feb 11, 2025 |
| Linux | govulncheck-vulndb sles 15.6 | 0.0.20250207T224745-150000.1.32.1 | [SUSE-SU-2025:0429-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0429-1.md) | Feb 11, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.