Oracle Linux 8 ELSA-2026-30853 git-lfs Important Patch CVE-2026

Back Linuxsecurity

Oracle Linux 8 ELSA-2026-30853 git-lfs Important Patch CVE-2026

Linuxsecurity •LinuxSecurity Advisories • June 30, 2026

Share: View original

[3.4.1-11] - Backport CVE-2026-39821 fix (vendored golang.org/x/net IDNA) - Resolves: RHEL-183731

[3.4.1-11] - Backport CVE-2026-39821 fix (vendored golang.org/x/net IDNA) - Resolves: RHEL-183731

git-lfs-3.4.1-11.el8_10.x86_64.rpm

git-lfs-3.4.1-11.el8_10.x86_64.rpm

git-lfs-3.4.1-11.el8_10.aarch64.rpm

git-lfs-3.4.1-11.el8_10.aarch64.rpm

Related CVEs: CVE-2026-39821

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux git-lfs Vulnerability Advisory for Versions 8 and 9 Oracle has released important security advisories for git-lfs affecting Oracle Linux 8 and 9. Both advisories address CVE-2026-39821, which was published on May 22, 2026. The vulnerability involves the vendored golang.org/x/net/idna ToUnicode function incorrectly accepting all-ASCII xn-- labels. This flaw can potentially allow unauthorized remote access. Oracle Linux 9 received a direct fix, while Oracle Linux 8 received a backported patch. The advisories highlight the importance of updating to the latest versions to mitigate potential risks. Users are encouraged to apply the patches promptly to secure their systems. 2 sources 58

Extracted Entities

CVEs (1)

Domains (1)

Platforms (1)