# git-lfs security updates Patch Radar has 47 security fixes for git-lfs, closing 47 CVEs. The newest is RHSA-2026:90757 (3.6.1-2.el10_0.8), released October 29, 2026. - Web page: https://patchblox.com/security/product/linux/git-lfs - Platform: Linux - Supported: yes ## Security fixes, newest first | Fix | Released | Fixed in | Priority | CVEs | Exploited | |---|---|---|---|---:|---:| | [RHSA-2026:90757](https://patchblox.com/security/data/fix/linux/rhsa-2026-90757.md) | Oct 29, 2026 | RHEL 10 3.6.1-2.el10_0.8 | High | 1 | 0 | | [RHSA-2026:67161](https://patchblox.com/security/data/fix/linux/rhsa-2026-67161.md) | Sep 19, 2026 | RHEL 8 0:3.4.1-13.el8_10 | High | 3 | 0 | | [RHSA-2026:66364](https://patchblox.com/security/data/fix/linux/rhsa-2026-66364.md) | Sep 13, 2026 | RHEL 9 0:3.7.1-4.el9_8.3 | High | 5 | 0 | | [RHSA-2026:39319](https://patchblox.com/security/data/fix/linux/rhsa-2026-39319.md) | Jul 18, 2026 | RHEL 9 0:3.7.1-4.el9_8.2 | High | 1 | 0 | | [RHSA-2026:39266](https://patchblox.com/security/data/fix/linux/rhsa-2026-39266.md) | Jul 18, 2026 | RHEL 8 0:3.4.1-12.el8_10 | High | 1 | 0 | | [RHSA-2026:67149](https://patchblox.com/security/data/fix/linux/rhsa-2026-67149.md) | Jun 30, 2026 | RHEL 10 3.6.1-2.el10_0.7 | Urgent | 7 | 0 | | [RHSA-2026:30854](https://patchblox.com/security/data/fix/linux/rhsa-2026-30854.md) | Jun 29, 2026 | RHEL 9 0:3.7.1-4.el9_8.1 | Urgent | 1 | 0 | | [RHSA-2026:30853](https://patchblox.com/security/data/fix/linux/rhsa-2026-30853.md) | Jun 29, 2026 | RHEL 8 0:3.4.1-11.el8_10 | Urgent | 1 | 0 | | [RHSA-2026:19350](https://patchblox.com/security/data/fix/linux/rhsa-2026-19350.md) | May 15, 2026 | RHEL 9 0:3.7.1-4.el9_8 | High | 8 | 0 | | [RHSA-2026:16875](https://patchblox.com/security/data/fix/linux/rhsa-2026-16875.md) | May 15, 2026 | RHEL 8 0:3.4.1-10.el8_10 | High | 4 | 0 | | [RHSA-2026:7259](https://patchblox.com/security/data/fix/linux/rhsa-2026-7259.md) | Apr 15, 2026 | RHEL 9 0:3.6.1-8.el9_7 | High | 1 | 0 | | [RHSA-2026:19715](https://patchblox.com/security/data/fix/linux/rhsa-2026-19715.md) | Apr 8, 2026 | RHEL 10 3.6.1-2.el10_0.4 | High | 3 | 0 | | [RHSA-2026:3928](https://patchblox.com/security/data/fix/linux/rhsa-2026-3928.md) | Mar 12, 2026 | RHEL 9 0:3.6.1-7.el9_7 | High | 3 | 0 | | [RHSA-2026:3985](https://patchblox.com/security/data/fix/linux/rhsa-2026-3985.md) | Mar 12, 2026 | RHEL 8 0:3.4.1-8.el8_10 | High | 2 | 0 | | [RHSA-2026:9435](https://patchblox.com/security/data/fix/linux/rhsa-2026-9435.md) | Mar 6, 2026 | RHEL 10 3.6.1-2.el10_0.3 | High | 1 | 0 | | [RHSA-2026:2323](https://patchblox.com/security/data/fix/linux/rhsa-2026-2323.md) | Feb 9, 2026 | RHEL 8 0:3.4.1-7.el8_10 | High | 1 | 0 | | [RHSA-2026:4166](https://patchblox.com/security/data/fix/linux/rhsa-2026-4166.md) | Feb 5, 2026 | RHEL 10 3.6.1-2.el10_0.2 | High | 3 | 0 | | [RHSA-2025:23744](https://patchblox.com/security/data/fix/linux/rhsa-2025-23744.md) | Jan 16, 2026 | RHEL 9 0:3.6.1-4.el9_7 | High | 1 | 0 | | [RHSA-2025:23745](https://patchblox.com/security/data/fix/linux/rhsa-2025-23745.md) | Jan 16, 2026 | RHEL 8 0:3.4.1-6.el8_10 | High | 1 | 0 | | [DEBIAN-CVE-2025-26625](https://patchblox.com/security/data/fix/linux/debian-cve-2025-26625.md) | Oct 17, 2025 | Debian 12.15 (bookworm) 3.3.0-1+deb12u2 | High | 1 | 0 | | [DEBIAN-CVE-2025-26625](https://patchblox.com/security/data/fix/linux/debian-cve-2025-26625.md) | Oct 17, 2025 | Debian 14 3.7.1-1 | High | 1 | 0 | | [DEBIAN-CVE-2025-26625](https://patchblox.com/security/data/fix/linux/debian-cve-2025-26625.md) | Oct 17, 2025 | Debian 13.5 (trixie) 3.6.1-1+deb13u1 | High | 1 | 0 | | [RHSA-2026:0224](https://patchblox.com/security/data/fix/linux/rhsa-2026-0224.md) | Oct 17, 2025 | RHEL 10 3.6.1-2.el10_0.1 | High | 1 | 0 | | [git-lfs 3.4.1-1ubuntu0.3+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-git-lfs-3.4.1-1ubuntu0.3-esm2.md) | Oct 17, 2025 | Ubuntu 24.04.5 LTS (noble) 3.4.1-1ubuntu0.3+esm2 | High | 2 | 0 | | [git-lfs 3.6.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-git-lfs-3.6.1-1ubuntu0.1.md) | Oct 17, 2025 | Ubuntu 25.10 (questing) 3.6.1-1ubuntu0.1 | High | 1 | 0 | | [RHSA-2025:9060](https://patchblox.com/security/data/fix/linux/rhsa-2025-9060.md) | Jun 16, 2025 | RHEL 8 0:3.4.1-5.el8_10 | High | 1 | 0 | | [RHSA-2025:9106](https://patchblox.com/security/data/fix/linux/rhsa-2025-9106.md) | Jun 16, 2025 | RHEL 9 0:3.6.1-2.el9_6 | High | 1 | 0 | | [RHSA-2025:7256](https://patchblox.com/security/data/fix/linux/rhsa-2025-7256.md) | May 13, 2025 | RHEL 9 0:3.6.1-1.el9 | High | 6 | 0 | | [RHSA-2025:9063](https://patchblox.com/security/data/fix/linux/rhsa-2025-9063.md) | Apr 8, 2025 | RHEL 10 3.6.1-2.el10_0 | High | 1 | 0 | | [RHSA-2025:0845](https://patchblox.com/security/data/fix/linux/rhsa-2025-0845.md) | Jan 30, 2025 | RHEL 8 0:3.4.1-4.el8_10 | High | 1 | 0 | | [DSA-5849-1](https://patchblox.com/security/data/fix/linux/dsa-5849-1.md) | Jan 24, 2025 | Debian 12.15 (bookworm) 3.3.0-1+deb12u1 | High | 1 | 0 | | [RHSA-2025:0673](https://patchblox.com/security/data/fix/linux/rhsa-2025-0673.md) | Jan 23, 2025 | RHEL 9 0:3.4.1-4.el9_5 | High | 1 | 0 | | [DLA-4028-1](https://patchblox.com/security/data/fix/linux/dla-4028-1.md) | Jan 22, 2025 | Debian 11.6 (bullseye) 2.13.2-1+deb11u1 | High | 1 | 0 | | [DEBIAN-CVE-2024-53263](https://patchblox.com/security/data/fix/linux/debian-cve-2024-53263.md) | Jan 14, 2025 | Debian 13.5 (trixie) 3.5.0-2 | High | 1 | 0 | | [DEBIAN-CVE-2024-53263](https://patchblox.com/security/data/fix/linux/debian-cve-2024-53263.md) | Jan 14, 2025 | Debian 14 3.5.0-2 | High | 1 | 0 | | [git-lfs 2.3.4-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-git-lfs-2.3.4-1ubuntu0.1-esm1.md) | Jan 14, 2025 | Ubuntu 18.04.6 LTS (bionic) 2.3.4-1ubuntu0.1~esm1 | High | 1 | 0 | | [git-lfs 2.9.2-1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-git-lfs-2.9.2-1ubuntu0.1-esm2.md) | Jan 14, 2025 | Ubuntu 20.04 LTS (focal) 2.9.2-1ubuntu0.1~esm2 | High | 1 | 0 | | [git-lfs 3.0.2-1ubuntu0.3+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-git-lfs-3.0.2-1ubuntu0.3-esm2.md) | Jan 14, 2025 | Ubuntu 22.04.1 LTS (jammy) 3.0.2-1ubuntu0.3+esm2 | High | 1 | 0 | | [RHSA-2024:7135](https://patchblox.com/security/data/fix/linux/rhsa-2024-7135.md) | Sep 25, 2024 | RHEL 8 0:3.4.1-3.el8_10 | High | 1 | 0 | | [RHSA-2024:7136](https://patchblox.com/security/data/fix/linux/rhsa-2024-7136.md) | Sep 25, 2024 | RHEL 9 0:3.4.1-4.el9_4 | High | 1 | 0 | | [RHSA-2024:3346](https://patchblox.com/security/data/fix/linux/rhsa-2024-3346.md) | May 23, 2024 | RHEL 8 0:3.4.1-2.el8_10 | High | 4 | 0 | | [RHBA-2024:3053](https://patchblox.com/security/data/fix/linux/rhba-2024-3053.md) | May 22, 2024 | RHEL 8 0:3.4.1-1.el8 | Routine | 1 | 0 | | [RHSA-2024:2724](https://patchblox.com/security/data/fix/linux/rhsa-2024-2724.md) | May 7, 2024 | RHEL 9 0:3.4.1-2.el9_4 | High | 4 | 0 | | [RHBA-2024:2274](https://patchblox.com/security/data/fix/linux/rhba-2024-2274.md) | Apr 30, 2024 | RHEL 9 0:3.4.1-1.el9 | Routine | 1 | 0 | | [RHSA-2023:2866](https://patchblox.com/security/data/fix/linux/rhsa-2023-2866.md) | May 16, 2023 | RHEL 8 0:3.2.0-2.el8 | High | 3 | 0 | | [RHSA-2023:2357](https://patchblox.com/security/data/fix/linux/rhsa-2023-2357.md) | May 9, 2023 | RHEL 9 0:3.2.0-1.el9 | High | 10 | 0 | | [RHSA-2022:7129](https://patchblox.com/security/data/fix/linux/rhsa-2022-7129.md) | Oct 25, 2022 | RHEL 8 0:2.13.3-3.el8_6 | High | 9 | 0 | --- Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo