{"id":"CLSA-2026-1784820017","summary":"git-lfs: Fix of 2 CVEs","details":"- CVE-2026-32280: rebuild with newer golang to fix uncontrolled resource\n  consumption in crypto/x509 chain building, where attacker-supplied\n  intermediate certificates differing only in non-critical extensions bypass\n  the dedup check and cause excessive work past the signature-check limit\n  (denial of service); fix carried by golang \u003e= 1.22.9-1.tuxcare.els9 via\n  upstream Go commit 7b4ed1d7 (release-branch.go1.26), CL 758320","modified":"2026-10-26T09:30:27.678772249Z","published":"2026-08-03T12:09:35Z","upstream":["CVE-2026-32280"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784820017.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821"}],"affected":[{"package":{"name":"git-lfs","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/git-lfs?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1.el9_2.tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1784820017.json"}}],"schema_version":"1.9.0"}