{"id":"CVE-2024-53263","aliases":["ALSA-2025:0673","ALSA-2025:0845","AZL-55644","AZL-55670","BIT-git-lfs-2024-53263","CLSA-2025-1762867600","DEBIAN-CVE-2024-53263","DLA-4028-1","DSA-5849-1","EUVD-2025-0077","GHSA-q6r2-x2cc-vrp7","GO-2025-3390","MGASA-2025-0028","RHSA-2025:0673","RHSA-2025:0757","RHSA-2025:0758","RHSA-2025:0759","RHSA-2025:0762","RHSA-2025:0765","RHSA-2025:0825","RHSA-2025:0845","RLSA-2025:0673","RLSA-2025:0845","SUSE-SU-2025:0297-1","UBUNTU-CVE-2024-53263","USN-7977-1","openSUSE-SU-2025:0153-1","openSUSE-SU-2025:14649-1","openSUSE-SU-2025:14653-1"],"status":"published","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01063,"percentile":0.64857,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436","CWE-74"],"published":"2025-01-14T19:33:21Z","modified":"2026-11-02T12:02:56Z","fixes":[{"ecosystem":"Go","package":"github.com/git-lfs/git-lfs/v3","fixed_in":["3.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"git-lfs","fixed_in":["3.4.1-4.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"git-lfs","fixed_in":["3.4.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"git-lfs","fixed_in":["3.5.1-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"git-lfs","fixed_in":["3.6.1-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"git-lfs","fixed_in":["3.6.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-lfs","fixed_in":["3.2.0-1.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"git-lfs","fixed_in":["3.3.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"git-lfs","fixed_in":["3.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"git-lfs","fixed_in":["3.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"git-lfs","fixed_in":["2.13.2-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"git-lfs","fixed_in":["3.2.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs","fixed_in":["0:3.4.1-4.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debuginfo","fixed_in":["0:3.4.1-4.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debugsource","fixed_in":["0:3.4.1-4.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"git-lfs","fixed_in":["0:3.2.0-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"git-lfs-debuginfo","fixed_in":["0:3.2.0-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"git-lfs-debugsource","fixed_in":["0:3.2.0-2.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"git-lfs","fixed_in":["0:2.13.3-5.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-5.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-5.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-lfs","fixed_in":["0:3.4.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-lfs-debuginfo","fixed_in":["0:3.4.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-lfs-debugsource","fixed_in":["0:3.4.1-4.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"git-lfs","fixed_in":["0:3.2.0-2.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"git-lfs-debuginfo","fixed_in":["0:3.2.0-2.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"git-lfs-debugsource","fixed_in":["0:3.2.0-2.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"git-lfs","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"git-lfs","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"git-lfs","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-3.el8_6.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"git-lfs","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"git-lfs","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"git-lfs","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"git-lfs-debuginfo","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"git-lfs-debugsource","fixed_in":["0:2.13.3-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs","fixed_in":["0:3.4.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs-debuginfo","fixed_in":["0:3.4.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs-debugsource","fixed_in":["0:3.4.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"git-lfs","fixed_in":["0:3.4.1-4.el9_4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"git-lfs","fixed_in":["0:3.4.1-4.el8_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"git-lfs","fixed_in":["2.3.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"git-lfs","fixed_in":["2.9.2-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"git-lfs","fixed_in":["3.0.2-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"git-lfs","fixed_in":["3.4.1-1ubuntu0.3+esm2"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"git-lfs","fixed_in":["3.6.1-bp156.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"git-lfs","fixed_in":["3.6.1-bp156.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-lfs","fixed_in":["3.6.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/git-lfs/git-lfs/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.6.0"},{"fixed":"3.6.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/git-lfs/git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.0"},{"last_affected":"3.0.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"git-lfs","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"3.6.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1+deb12u1"}]}],"versions":["3.3.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.2-1+deb11u1"}]}],"versions":["2.13.2-1"]},{"source":"osv","ecosystem":"Debian:12","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1+deb12u1"}]}],"versions":["3.3.0-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/git-lfs/git-lfs","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"last_affected":"3.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/git-lfs/git-lfs/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/git-lfs/git-lfs","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/git-lfs/git-lfs/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.6.1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-2.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-5.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-5.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-5.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-2.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-2.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-2.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_6.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.3-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"git-lfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el9_4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-4.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1ubuntu0.1~esm1"}]}],"versions":["2.2.1-1","2.3.3-1","2.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1ubuntu0.1~esm2"}]}],"versions":["2.8.0-4","2.9.0-1","2.9.1-1","2.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1ubuntu0.3+esm2"}]}],"versions":["2.13.2-1","3.0.2-1","3.0.2-1ubuntu0.1","3.0.2-1ubuntu0.2","3.0.2-1ubuntu0.3","3.0.2-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1ubuntu0.3+esm2"}]}],"versions":["3.4.0-1build1","3.4.1-1","3.4.1-1ubuntu0.1","3.4.1-1ubuntu0.2","3.4.1-1ubuntu0.2+esm1","3.4.1-1ubuntu0.3","3.4.1-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4-1ubuntu0.1~esm1"}]}],"versions":["2.2.1-1","2.3.3-1","2.3.4-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1ubuntu0.1~esm2"}]}],"versions":["2.8.0-4","2.9.0-1","2.9.1-1","2.9.2-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-1ubuntu0.3+esm2"}]}],"versions":["2.13.2-1","3.0.2-1","3.0.2-1ubuntu0.1","3.0.2-1ubuntu0.2","3.0.2-1ubuntu0.3","3.0.2-1ubuntu0.3+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1ubuntu0.3+esm2"}]}],"versions":["3.4.0-1build1","3.4.1-1","3.4.1-1ubuntu0.1","3.4.1-1ubuntu0.2","3.4.1-1ubuntu0.2+esm1","3.4.1-1ubuntu0.3","3.4.1-1ubuntu0.3+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1ubuntu0.1"}]}],"versions":["3.6.1-1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-bp156.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-bp156.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-lfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250115T172141-1.1"}]}],"bundled":5}],"products":[{"vendor":"git-lfs","product":"git-lfs"}],"references":[{"url":"https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7","tags":["x_refsource_CONFIRM","web","advisory","article","report"]},{"url":"https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90","tags":["x_refsource_MISC","web","fix","article","report"]},{"url":"https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00022.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53263","tags":["web","advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3390","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q6r2-x2cc-vrp7"},{"url":"https://access.redhat.com/errata/RHSA-2025:0673","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53263","tags":["report"]},{"url":"https://bugzilla.redhat.com/2338002","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-0673.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0845","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-0845.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762867600.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53263.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53263","tags":["advisory"]},{"url":"https://github.com/git-lfs/git-lfs","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0028.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33931","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/U4RACGLXZEZGUX7BZLFN4GQOHFBHL6FO/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2025/msg00011.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2338002","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0673.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53263","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0757","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0757.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0758","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0758.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0759","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0759.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0762","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0762.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0765","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0765.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0825","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0825.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0845.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:0673","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:0845","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24355","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-53263","tags":["report"]},{"url":"https://github.com/git-lfs/git-lfs/commit/44236960abcebdcc5889d8814e274fbe66d0f4e1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7977-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-26625","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUJEMV422T3LAPI4DRX6RNNLCCUYCIHN/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235876","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U4RACGLXZEZGUX7BZLFN4GQOHFBHL6FO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3ISCFQBRATG2LAA3K5XNETXSCP77AAKA/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-53263","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T19:33:21.876Z","modified":"2026-02-26T19:09:07.898Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2025-0077","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T19:33:21Z","modified":"2026-02-26T19:09:07Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:15.753271Z"}],"ghsa":[{"id":"GHSA-q6r2-x2cc-vrp7","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs","description":"### Impact\n\nWhen Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host.  By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials.\n\n### Patches\n\nThis problem exists in all previous versions and is patched in v3.6.1.  All users should upgrade to v3.6.1.\n\n### Workarounds\n\nThere are no workarounds known at this time.\n\n### References\n\n* https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7\n* https://nvd.nist.gov/vuln/detail/CVE-2024-53263\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53263\n* https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1\n* [git-lfs/git-lfs@0345b6f816](https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* For general questions, start a discussion in the Git LFS [discussion forum](https://github.com/git-lfs/git-lfs/discussions).\n* For reports of additional vulnerabilities, please follow the Git LFS [security reporting policy](https://github.com/git-lfs/git-lfs/blob/main/SECURITY.md).","status":"published","published":"2025-01-14T21:20:42Z","modified":"2025-01-23T18:31:17Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-74","CWE-436"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2024-53263","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T20:15:28.61Z","modified":"2026-06-17T08:08:42.903Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:10:42.329342Z"}],"osv":[{"id":"CVE-2024-53263","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T19:33:21.876Z","modified":"2026-10-28T02:30:45.232147359Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53263","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T20:15:28.61Z","modified":"2026-11-02T12:02:56.814013908Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"GHSA-q6r2-x2cc-vrp7","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs","description":"### Impact\n\nWhen Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host.  By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials.\n\n### Patches\n\nThis problem exists in all previous versions and is patched in v3.6.1.  All users should upgrade to v3.6.1.\n\n### Workarounds\n\nThere are no workarounds known at this time.\n\n### References\n\n* https://github.com/git-lfs/git-lfs/security/advisories/GHSA-q6r2-x2cc-vrp7\n* https://nvd.nist.gov/vuln/detail/CVE-2024-53263\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53263\n* https://github.com/git-lfs/git-lfs/releases/tag/v3.6.1\n* [git-lfs/git-lfs@0345b6f816](https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90)\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* For general questions, start a discussion in the Git LFS [discussion forum](https://github.com/git-lfs/git-lfs/discussions).\n* For reports of additional vulnerabilities, please follow the Git LFS [security reporting policy](https://github.com/git-lfs/git-lfs/blob/main/SECURITY.md).","status":"published","published":"2025-01-14T21:20:42Z","modified":"2025-01-23T18:31:17Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-436","CWE-74"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"RHSA-2025:0673","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-24T10:02:23Z","modified":"2026-03-18T11:36:51.672987Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0757","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-29T10:04:05Z","modified":"2026-03-18T11:36:54.63569Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0758","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-29T10:04:05Z","modified":"2026-03-18T11:36:52.447759Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0759","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-29T10:04:06Z","modified":"2026-03-18T11:36:53.008068Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0762","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-29T10:04:06Z","modified":"2026-03-18T11:36:52.36076Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0765","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-29T10:04:07Z","modified":"2026-03-18T11:36:53.594592Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0825","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-30T10:03:48Z","modified":"2026-03-18T11:36:53.604Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0845","title":"Red Hat Security Advisory: git-lfs security update","status":"published","published":"2025-01-31T10:02:15Z","modified":"2026-03-18T11:36:53.062425Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2024-53263","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T20:15:00Z","modified":"2026-02-04T02:56:59.596813Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"ALSA-2025:0673","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  \n\nSecurity Fix(es):  \n\n  * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-01-23T00:00:00Z","modified":"2026-10-29T11:32:12.251497155Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:0845","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.  \n\nSecurity Fix(es):  \n\n  * git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-01-30T00:00:00Z","modified":"2026-10-29T11:02:22.266645785Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-55644","title":"CVE-2024-53263 affecting package git-lfs for versions less than 3.5.1-4","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T20:15:28Z","modified":"2026-04-21T04:35:57.68644Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-55670","title":"CVE-2024-53263 affecting package git-lfs for versions less than 3.6.1-1","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-01-14T20:15:28Z","modified":"2026-04-21T04:47:26.580307Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"BIT-git-lfs-2024-53263","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs","description":"Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.","status":"published","published":"2025-04-14T11:02:20.252Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:29.999658Z"},{"id":"CLSA-2025-1762867600","title":"git-lfs: Fix of CVE-2024-53263","description":"- CVE-2024-53263: fix issue where Git LFS could expose user credentials via URL-\n  encoded control characters in host's URL","status":"published","published":"2025-11-11T13:26:45Z","modified":"2026-06-01T00:31:24.381762869Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-4028-1","title":"git-lfs - security update","status":"published","published":"2025-01-22T00:00:00Z","modified":"2026-03-09T01:18:58.878743Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5849-1","title":"git-lfs - security update","status":"published","published":"2025-01-24T00:00:00Z","modified":"2026-03-09T02:09:48.677725Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"GO-2025-3390","title":"Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs","description":"Git LFS permits exfiltration of credentials via crafted HTTP URLs in github.com/git-lfs/git-lfs","status":"published","published":"2025-01-15T17:21:41Z","modified":"2026-03-03T04:57:08.780552Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"MGASA-2025-0028","title":"Updated git-lfs packages fix security vulnerability","description":"Git LFS permits exfiltration of credentials via crafted HTTP URLs.\n(CVE-2024-53263)\n","status":"published","published":"2025-01-30T18:36:39Z","modified":"2026-04-16T04:43:31.491229072Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2025:0153-1","title":"Security update for git-lfs","description":"This update for git-lfs fixes the following issues:\n\nUpdate to 3.6.1: (boo#1235876):\n\n  This release introduces a security fix for all platforms, which\n  has been assigned CVE-2024-53263.\n\n  When requesting credentials from Git for a remote host, prior\n  versions of Git LFS passed portions of the host's URL to the\n  git-credential(1) command without checking for embedded\n  line-ending control characters, and then sent any credentials\n  received back from the Git credential helper to the remote host.\n  By inserting URL-encoded control characters such as line feed\n  (LF) or carriage return (CR) characters into the URL, an attacker\n  might have been able to retrieve a user's Git credentials.\n  Git LFS now prevents bare line feed (LF) characters from being\n  included in the values sent to the git-credential(1) command, and\n  also prevents bare carriage return (CR) characters from being\n  included unless the credential.protectProtocol configuration\n  option is set to a value equivalent to false.\n\n  * Bugs\n\n    - Reject bare line-ending control characters in Git credential\n      requests (@chrisd8088)\n\nupdate to version 3.6.0:\n\n- https://github.com/git-lfs/git-lfs/releases/tag/v3.6.0\n\nupdate to 3.5.1:\n\n  * Build release assets with Go 1.21 #5668 (@bk2204)\n  * script/packagecloud: instantiate distro map properly #5662\n    (@bk2204)\n  * Install msgfmt on Windows in CI and release workflows\n    #5666 (@chrisd8088)\n\nupdate to version 3.4.1:\n\n- https://github.com/git-lfs/git-lfs/releases/tag/v3.4.1\n\n","status":"published","published":"2025-05-12T16:01:51Z","modified":"2026-02-04T03:58:46.822652Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14649-1","title":"git-lfs-3.6.1-1.1 on GA media","description":"These are all security issues fixed in the git-lfs-3.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-15T00:00:00Z","modified":"2026-02-04T02:53:35.129591Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14653-1","title":"govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250115T172141-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-16T00:00:00Z","modified":"2026-02-04T03:45:57.259345Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2025:0673","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-13T20:35:44.459056Z","modified":"2026-02-04T07:40:22.089393Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2025:0845","title":"Important: git-lfs security update","description":"Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs (CVE-2024-53263)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-13T20:34:26.141542Z","modified":"2026-02-04T10:30:04.398406Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2025:0297-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n  * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n  * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n  * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n  * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n  * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n  * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n  * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n  * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3372 CVE-2024-45339\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n  * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n  * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n  * GO-2025-3396 CVE-2024-52594\n  * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n  * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n  * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n  * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n  * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n  * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n  * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n  * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n  * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n  * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n  * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n  * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n  * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n","status":"published","published":"2025-01-30T14:03:37Z","modified":"2026-02-05T11:21:44.836869Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"USN-7977-1","title":"git-lfs vulnerabilities","description":"Ryota K discovered that Git LFS may leak login credentials in certain\ninstances due to failing to check for URL-encoded characters. An\nattacker could possibly use this issue to learn sensitive information.\n(CVE-2024-53263)\n\nIt was discovered that Git LFS could have its git lfs checkout and\ngit lfs pull commands abused to write to any file on a user's\nsystem. An attacker could possibly use this issue to execute arbitrary\ncode. This issue was only addressed in Ubuntu 24.04 LTS and\nUbuntu 25.10. (CVE-2025-26625)","status":"published","published":"2026-01-26T13:50:53Z","modified":"2026-04-27T18:34:21.87742Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}