# CVE-2025-47906: git-lfs: Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text poi...

CVE-2025-47906 is fixed in 29 products on 1 platform, first by SUSE-SU-2025:02759-1, released August 12, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-47906
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0055
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 12, 2025

## Description

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  Security Fix(es):  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)  * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)  * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cri-o1.31 Fedora 43 | 1.31.13-1.fc43 | [FEDORA-2025-20A9E0E990](https://patchblox.com/security/data/fix/linux/fedora-2025-20a9e0e990.md) | Oct 2, 2025 |
| Linux | cri-o1.31-debuginfo Fedora 43 | 1.31.13-1.fc43 | [FEDORA-2025-20A9E0E990](https://patchblox.com/security/data/fix/linux/fedora-2025-20a9e0e990.md) | Oct 2, 2025 |
| Linux | cri-o1.31-debugsource Fedora 43 | 1.31.13-1.fc43 | [FEDORA-2025-20A9E0E990](https://patchblox.com/security/data/fix/linux/fedora-2025-20a9e0e990.md) | Oct 2, 2025 |
| Linux | delve RHEL 8 | 0:1.25.2-1.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | delve almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | delve ol 8 | 0:1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | delve rocky 8 | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | [RLSA-2025:22668](https://patchblox.com/security/data/fix/linux/rlsa-2025-22668.md) | Dec 4, 2025 |
| Linux | git-lfs RHEL 9 | 0:3.7.1-4.el9_8 | [RHSA-2026:19350](https://patchblox.com/security/data/fix/linux/rhsa-2026-19350.md) | May 15, 2026 |
| Linux | git-lfs almalinux 9 | 3.7.1-4.el9_8 | [ALSA-2026:19350](https://patchblox.com/security/data/fix/linux/alsa-2026-19350.md) | May 19, 2026 |
| Linux | go-filesystem RHEL 9 | 0:3.6.0-12.el9_7 | [RHSA-2025:22005](https://patchblox.com/security/data/fix/linux/rhsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-filesystem almalinux 9 | 3.6.0-12.el9_7 | [ALSA-2025:22005](https://patchblox.com/security/data/fix/linux/alsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-filesystem ol 9 | 0:3.6.0-12.el9_7 | [ELSA-2025-22005](https://patchblox.com/security/data/fix/linux/elsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-rpm-macros RHEL 9 | 0:3.6.0-12.el9_7 | [RHSA-2025:22005](https://patchblox.com/security/data/fix/linux/rhsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-rpm-macros almalinux 9 | 3.6.0-12.el9_7 | [ALSA-2025:22005](https://patchblox.com/security/data/fix/linux/alsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-rpm-macros ol 9 | 0:3.6.0-12.el9_7 | [ELSA-2025-22005](https://patchblox.com/security/data/fix/linux/elsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-rpm-macros rocky 9 | 0:3.6.0-12.el9_7 | [RLSA-2025:22005](https://patchblox.com/security/data/fix/linux/rlsa-2025-22005.md) | Nov 28, 2025 |
| Linux | go-rpm-templates RHEL 9 | 0:3.6.0-12.el9_7 | [RHSA-2025:22005](https://patchblox.com/security/data/fix/linux/rhsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-rpm-templates almalinux 9 | 3.6.0-12.el9_7 | [ALSA-2025:22005](https://patchblox.com/security/data/fix/linux/alsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-rpm-templates ol 9 | 0:3.6.0-12.el9_7 | [ELSA-2025-22005](https://patchblox.com/security/data/fix/linux/elsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-srpm-macros RHEL 9 | 0:3.6.0-12.el9_7 | [RHSA-2025:22005](https://patchblox.com/security/data/fix/linux/rhsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-srpm-macros almalinux 9 | 3.6.0-12.el9_7 | [ALSA-2025:22005](https://patchblox.com/security/data/fix/linux/alsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-srpm-macros ol 9 | 0:3.6.0-12.el9_7 | [ELSA-2025-22005](https://patchblox.com/security/data/fix/linux/elsa-2025-22005.md) | Nov 25, 2025 |
| Linux | go-toolset RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | go-toolset RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | go-toolset almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | go-toolset ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | go1.23 opensuse-leap 15.6 | 1.23.12-150000.1.40.1 | [SUSE-SU-2025:02759-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02759-1.md) | Aug 12, 2025 |
| Linux | go1.23 sles 15.6 | 1.23.12-150000.1.40.1 | [SUSE-SU-2025:02759-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02759-1.md) | Aug 12, 2025 |
| Linux | go1.23 sles 15.7 | 1.23.12-150000.1.40.1 | [SUSE-SU-2025:02759-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02759-1.md) | Aug 12, 2025 |
| Linux | go1.23-openssl opensuse-leap 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.23-openssl sles 15.7 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 |
| Linux | go1.24 opensuse-leap 15.6 | 1.24.6-150000.1.32.1 | [SUSE-SU-2025:02760-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02760-1.md) | Aug 12, 2025 |
| Linux | go1.24 sles 15.6 | 1.24.6-150000.1.32.1 | [SUSE-SU-2025:02760-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02760-1.md) | Aug 12, 2025 |
| Linux | go1.24 sles 15.7 | 1.24.6-150000.1.32.1 | [SUSE-SU-2025:02760-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02760-1.md) | Aug 12, 2025 |
| Linux | go1.24-openssl opensuse-leap 15.6 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 |
| Linux | go1.24-openssl sles 15.6 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 |
| Linux | go1.24-openssl sles 15.7 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 |
| Linux | go1.25 opensuse-leap 15.6 | 1.25.0-150000.1.5.1 | [SUSE-SU-2025:02924-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02924-1.md) | Aug 20, 2025 |
| Linux | go1.25 sles 15.6 | 1.25.0-150000.1.5.1 | [SUSE-SU-2025:02924-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02924-1.md) | Aug 20, 2025 |
| Linux | go1.25 sles 15.7 | 1.25.0-150000.1.5.1 | [SUSE-SU-2025:02924-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02924-1.md) | Aug 20, 2025 |
| Linux | go1.25-openssl opensuse-leap 15.6 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 |
| Linux | go1.25-openssl sles 15.6 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 |
| Linux | go1.25-openssl sles 15.7 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 |
| Linux | golang RHEL 10 | 1.24.6-1.el10_0 | [RHSA-2025:13941](https://patchblox.com/security/data/fix/linux/rhsa-2025-13941.md) | Sep 18, 2025 |
| Linux | golang RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | golang rocky 8 | 0:1.25.3-2.module+el8.10.0+40037+cec252d2 | [RLSA-2025:22668](https://patchblox.com/security/data/fix/linux/rlsa-2025-22668.md) | Dec 4, 2025 |
| Linux | golang-bin RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-bin RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang-bin almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-bin amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang-bin ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | golang-docs RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-docs RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang-docs almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-docs amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang-docs ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | golang-misc RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-misc RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang-misc almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-misc amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang-misc ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | golang-race RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-race RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang-race almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-race ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | golang-shared amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang-src RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-src RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang-src almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-src amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang-src ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | golang-tests RHEL 8 | 0:1.25.3-2.module+el8.10.0+23746+9db33b5e | [RHSA-2025:22668](https://patchblox.com/security/data/fix/linux/rhsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-tests RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 |
| Linux | golang-tests almalinux 8 | 1.25.3-2.module_el8.10.0+4074+24330916 | [ALSA-2025:22668](https://patchblox.com/security/data/fix/linux/alsa-2025-22668.md) | Dec 3, 2025 |
| Linux | golang-tests amzn 2023 | 1.24.6-1.amzn2023.0.1 | [ALAS2023-2025-1161](https://patchblox.com/security/data/fix/linux/alas2023-2025-1161.md) | Aug 22, 2025 |
| Linux | golang-tests ol 8 | 0:1.25.3-2.module+el8.10.0+90715+2d4d8dfd | [ELSA-2025-22668](https://patchblox.com/security/data/fix/linux/elsa-2025-22668.md) | Dec 5, 2025 |
| Linux | govulncheck-vulndb opensuse-leap 15.6 | 0.0.20250918T182144-150000.1.107.1 | [SUSE-SU-2025:03289-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03289-1.md) | Sep 22, 2025 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |
| Linux | govulncheck-vulndb sles 15.6 | 0.0.20250918T182144-150000.1.107.1 | [SUSE-SU-2025:03289-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03289-1.md) | Sep 22, 2025 |
| Linux | kubernetes1.31 Fedora 43 | 1.31.14-1.fc43 | [FEDORA-2025-5A4555EABC](https://patchblox.com/security/data/fix/linux/fedora-2025-5a4555eabc.md) | Nov 13, 2025 |
| Linux | kubernetes1.31-client Fedora 43 | 1.31.14-1.fc43 | [FEDORA-2025-5A4555EABC](https://patchblox.com/security/data/fix/linux/fedora-2025-5a4555eabc.md) | Nov 13, 2025 |
| Linux | kubernetes1.31-kubeadm Fedora 43 | 1.31.14-1.fc43 | [FEDORA-2025-5A4555EABC](https://patchblox.com/security/data/fix/linux/fedora-2025-5a4555eabc.md) | Nov 13, 2025 |
| Linux | kubernetes1.31-systemd Fedora 43 | 1.31.14-1.fc43 | [FEDORA-2025-5A4555EABC](https://patchblox.com/security/data/fix/linux/fedora-2025-5a4555eabc.md) | Nov 13, 2025 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.