Skip to content
Oracle Linux git-lfs Vulnerability Advisory for Versions 8 and 9

Oracle Linux git-lfs Vulnerability Advisory for Versions 8 and 9

First seen 1 Jul 2026, 10:45 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 2, 2026 at 10:13 UTC
  • •CVE-2026-39821 affects both Oracle Linux 8 and 9, allowing unauthorized remote access.
  • •Oracle Linux 9 received a direct fix, while Oracle Linux 8 received a backported patch.
  • •Users are urged to update their systems promptly to mitigate risks associated with this vulnerability.

Oracle has released important security advisories for git-lfs affecting Oracle Linux 8 and 9. Both advisories address CVE-2026-39821, which was published on May 22, 2026. The vulnerability involves the vendored golang.org/x/net/idna ToUnicode function incorrectly accepting all-ASCII xn-- labels. This flaw can potentially allow unauthorized remote access. Oracle Linux 9 received a direct fix, while Oracle Linux 8 received a backported patch. The advisories highlight the importance of updating to the latest versions to mitigate potential risks. Users are encouraged to apply the patches promptly to secure their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 100d ago How this analysis works

Timeline

2026-05-22
CVE-2026-39821 published
CVE-2026-39821 details a vulnerability in golang.org/x/net/idna that affects multiple systems.
Linuxsecurity
2026-06-30
Oracle Linux 8 advisory released
Oracle released ELSA-2026-30853 for Linux 8, addressing CVE-2026-39821 with a backported fix.
Linuxsecurity
2026-07-01
Oracle Linux 9 advisory released
Oracle released ELSA-2026-30854 for Linux 9, providing a direct fix for CVE-2026-39821.
Linuxsecurity

More articles in this cluster (2)

Following this threat?

Track CVE-2026-39821 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 2