Oracle Linux 9 git-lfs Important Remote Access Advisory ELSA-2026

Back Linuxsecurity

Oracle Linux 9 git-lfs Important Remote Access Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • July 1, 2026

Share: View original

[3.7.1-4.1] - Fix CVE-2026-39821: vendored golang.org/x/net/idna ToUnicode incorrectly accepting all-ASCII xn-- labels - Resolves: RHEL-183797

[3.7.1-4.1] - Fix CVE-2026-39821: vendored golang.org/x/net/idna ToUnicode incorrectly accepting all-ASCII xn-- labels - Resolves: RHEL-183797

git-lfs-3.7.1-4.el9_8.1.x86_64.rpm

git-lfs-3.7.1-4.el9_8.1.x86_64.rpm

git-lfs-3.7.1-4.el9_8.1.aarch64.rpm

git-lfs-3.7.1-4.el9_8.1.aarch64.rpm

Related CVEs: CVE-2026-39821

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Linux git-lfs Vulnerability Advisory for Versions 8 and 9 Oracle has released important security advisories for git-lfs affecting Oracle Linux 8 and 9. Both advisories address CVE-2026-39821, which was published on May 22, 2026. The vulnerability involves the vendored golang.org/x/net/idna ToUnicode function incorrectly accepting all-ASCII xn-- labels. This flaw can potentially allow unauthorized remote access. Oracle Linux 9 received a direct fix, while Oracle Linux 8 received a backported patch. The advisories highlight the importance of updating to the latest versions to mitigate potential risks. Users are encouraged to apply the patches promptly to secure their systems. 2 sources 58

Extracted Entities

CVEs (1)

Domains (1)

Platforms (1)