一、漏洞信息
漏洞编号：CVE-2026-25679
漏洞归属组件：git-lfs
漏洞归属的版本：2.12.0,3.2.0,3.5.1,3.6.1,3.7.0,3.7.1
CVSS评分：
BaseScore：7.5 High
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
[ announces: , We have just released Go versions 1.26.1 and 1.25.8, minor point releases. n nThese releases include 5 security fixes following the security policy: n n * crypto/x509: incorrect enforcement of email constraints n n When verifying a certificate chain which contains a certificate containing n multiple email address constraints (composed of the full email address) n which share common local portions (the portion of the address before the @ n character) but different domain portions (the portion of the address after n the @ character), these constraints will not be properly applied, and only n the last constraint will be considered. n n This can allow certificates in the chain containing email addresses which n are either not permitted or excluded by the relevant constraints to be n returned by calls to Certificate.Verify. Since the name constraint checks n happen after chain building is complete, this only applies to certificate n chains which chain to trusted roots (root certificates either in n VerifyOptions.Roots or in the system root certificate pool), requiring a n trusted CA to issue certificates containing either not permitted or n excluded email addresses. n n This issue only affects Go 1.26. n n Thanks to Jakub Ciolek for reporting this issue. n n This is CVE-2026-27137 and Go issue , . n n * crypto/x509: panic in name constraint checking for malformed certificates n n Certificate verification can panic when a certificate in the chain has an n empty DNS name and another certificate in the chain has excluded name n constraints. This can crash programs that are either directly verifying n X.509 certificate chains, or those that use TLS. n n Since the name constraint checks happen after chain building is complete, n this only applies to certificate chains which chain to trusted roots (root n certificates either in VerifyOptions.Roots or in the system root certificate n pool), requiring a trusted CA to issue certificates containing malformed DNS n names. n n This issue only affects Go 1.26. n n Thanks to Jakub Ciolek for reporting this issue. n n This is CVE-2026-27138 and Go issue , . n n * html/template: URLs in meta content attribute actions are not escaped n n Actions which insert URLs into the content attribute of HTML meta tags are n not escaped. This can allow XSS if the meta tag also has an http-equiv n attribute with the value refresh . n n A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be n used to disable escaping URLs in actions in the meta content attribute which n follow url= by setting htmlmetacontenturlescape=0. n n This is CVE-2026-27142 and Go issue , . n n * net/url: reject IPv6 literal not at start of host n n The Go standard library function net/url.Parse insufficiently n validated the host/authority component and accepted some invalid URLs n by effectively treating garbage before an IP-literal as ignorable. n The function should have rejected this as invalid. n n To prevent this behavior, net/url.Parse now rejects IPv6 literals n that do not appear at the start of the host subcomponent of a URL. n n Thanks to Masaki Hara ( , ) of Wantedly. n n This is CVE-2026-25679 and Go issue , . n n * os: FileInfo can escape from a Root n n On Unix platforms, when listing the contents of a directory using n File.ReadDir or File.Readdir the returned FileInfo could reference n a file outside of the Root in which the File was opened. n n The contents of the FileInfo were populated using the lstat system n call, which takes the path to the file as a parameter. If a component n of the full path of the file described by the FileInfo is replaced with n a symbolic link, the target of the lstat can be directed to another n location on the filesystem. n n The impact of this escape is limited to reading metadata provided by n lstat from arbitrary locations on the filesystem. This could be used n to probe for the presence or absence of files as well as gleaning n metadata like file sizes, but does not permit reading or writing files n outside the root. n n The FileInfo is now populated using fstatat. n n Thank you to Miloslav Trmač of Red Hat for reporting this issue. n n This is CVE-2026-27139 and Go issue , . n nView the release notes for more information: , You can download binary and source distributions from the Go website: , To compile from source using a Git clone, update to the release with ngit checkout go1.26.1 and build as usual. n nThanks to everyone who contributed to the releases. n nCheers, nCherry and David for the Go team ]
漏洞公开时间：2026-03-07 06:16:00
漏洞创建时间：2026-03-18 08:54:00
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-25679

漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：
新版本的git-lfs中该漏洞已修复
openEuler评分：
7.5
Vector：CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(3.8.0):受影响
2.openEuler-20.03-LTS-SP4:受影响
3.openEuler-22.03-LTS-SP4(3.5.1):受影响
4.openEuler-24.03-LTS(3.2.0):受影响
5.openEuler-24.03-LTS-Next(3.6.1):受影响
6.openEuler-24.03-LTS-SP1(3.6.1):受影响
7.openEuler-24.03-LTS-SP2(3.6.1):受影响
8.openEuler-24.03-LTS-SP3(3.6.1):受影响
9.openEuler-24.03-LTS-SP4(3.6.1):受影响

修复是否涉及abi变化(是/否)：
1.master(3.8.0):否
2.openEuler-20.03-LTS-SP4:否
3.openEuler-22.03-LTS-SP4(3.5.1):否
4.openEuler-24.03-LTS(3.2.0):否
5.openEuler-24.03-LTS-Next(3.6.1):否
6.openEuler-24.03-LTS-SP1(3.6.1):否
7.openEuler-24.03-LTS-SP2(3.6.1):否
8.openEuler-24.03-LTS-SP3(3.6.1):否
9.openEuler-24.03-LTS-SP4(3.6.1):否

原因说明：
1.master(3.8.0):正常修复
2.openEuler-20.03-LTS-SP4:不修复-超出修复范围
3.openEuler-22.03-LTS-SP4(3.5.1):不修复-超出修复范围
4.openEuler-24.03-LTS(3.2.0):不修复-超出修复范围
5.openEuler-24.03-LTS-Next(3.6.1):正常修复
6.openEuler-24.03-LTS-SP1(3.6.1):正常修复
7.openEuler-24.03-LTS-SP2(3.6.1):正常修复
8.openEuler-24.03-LTS-SP3(3.6.1):正常修复
9.openEuler-24.03-LTS-SP4(3.6.1):正常修复