Another affected use is in commitments where a hash function is meant to perfectly hide some information until time comes to reveal it. A function susceptible to length-extension would allow an adversary to attempt to link publicly known hashes (of unknown preimages) by testing whether their preimages are substrings of one another, thus weakening the unlinkability property. The attack is feasible only for smaller lengths, as it involves brute-forcing some N bytes of extensions to test any 2 hashes.
There is some literature discussing this:
The binding property of this commitment follows from the collision-resistance of the hash function H, since to be able to open the commitment in two different ways a malicious sender would need to find collisions in H. For the hiding property we need to assume that H is a random oracle. We think that this is satisfactory since anyway the security of the Bitcoin PoWs relies on the random oracle assumption. Clearly, if H is a random oracle then no adversary can obtain any information about x if he does not learn s (which an honest C keeps private until the opening phase).
Notice that use of single SHA-256 would be insecure here, because it is constructed using Merkle–Damgard transformation and therefore it is susceptible to the length extension attack . It this attack an adversary which knows H(x) can compute a value H(x||y) for some string y controlled by him without the knowledge of the original value x. It could allow to completely compromise the lottery protocol, because the winner choosing function (described later) highly depends on the lengths of the secrets.
M. Andrychowicz, S. Dziembowski, D. Malinowski and L. Mazurek, "Secure Multiparty Computations on Bitcoin," 2014 IEEE Symposium on Security and Privacy, 2014, pp. 443-458, doi: 10.1109/SP.2014.35.
The "unlinkability" property has a good definition here:
Unlinkability of two or more items of interest (IOIs, e.g., subjects, messages, actions, ...) from an attacker’s perspective means that within the system (comprising these and possibly other items), the attacker cannot sufficiently distinguish whether these IOIs are related or not.
See also: https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks, which provides a practical example and a hash_extender tool.