# git-lfs security updates

Patch Radar has 156 security fixes for git-lfs, closing 64 CVEs, 1 of which is being exploited. The newest security fix is ALAS2023-2026-3322 (3.7.1-82.amzn2023), released November 7, 2026.

- Web page: https://patchblox.com/security/product/linux/git-lfs
- Platform: Linux
- Supported: yes

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [ALAS2023-2026-3322](https://patchblox.com/security/data/fix/linux/alas2023-2026-3322.md) | Nov 7, 2026 | amzn 2023 3.7.1-82.amzn2023 | High | 4 | 0 |
| [RHSA-2026:90757](https://patchblox.com/security/data/fix/linux/rhsa-2026-90757.md) | Oct 29, 2026 | RHEL 10 3.6.1-2.el10_0.8 | High | 1 | 0 |
| [RHSA-2026:67161](https://patchblox.com/security/data/fix/linux/rhsa-2026-67161.md) | Sep 19, 2026 | RHEL 8 0:3.4.1-13.el8_10 | High | 3 | 0 |
| [RLSA-2026:67161](https://patchblox.com/security/data/fix/linux/rlsa-2026-67161.md) | Sep 15, 2026 | rocky 8 0:3.4.1-13.el8_10 | High | 3 | 0 |
| [ALSA-2026:67161](https://patchblox.com/security/data/fix/linux/alsa-2026-67161.md) | Sep 14, 2026 | almalinux 8 3.4.1-13.el8_10 | High | 3 | 0 |
| [ELSA-2026-67161-0](https://patchblox.com/security/data/fix/linux/elsa-2026-67161-0.md) | Sep 14, 2026 | ol 8 0:3.4.1-13.el8_10 | High | 3 | 0 |
| [RHSA-2026:66364](https://patchblox.com/security/data/fix/linux/rhsa-2026-66364.md) | Sep 13, 2026 | RHEL 9 0:3.7.1-4.el9_8.3 | High | 5 | 0 |
| [RLSA-2026:66364](https://patchblox.com/security/data/fix/linux/rlsa-2026-66364.md) | Sep 11, 2026 | rocky 9 0:3.7.1-4.el9_8.3 | High | 3 | 0 |
| [ALSA-2026:66364](https://patchblox.com/security/data/fix/linux/alsa-2026-66364.md) | Sep 10, 2026 | almalinux 9 3.7.1-4.el9_8.3 | High | 5 | 0 |
| [ELSA-2026-66364-0](https://patchblox.com/security/data/fix/linux/elsa-2026-66364-0.md) | Sep 10, 2026 | ol 9 0:3.7.1-4.el9_8.3 | High | 3 | 0 |
| [RLSA-2026:64788](https://patchblox.com/security/data/fix/linux/rlsa-2026-64788.md) | Sep 9, 2026 | rocky 10 0:3.7.1-5.el10_2.7 | High | 3 | 0 |
| [ALSA-2026:64788](https://patchblox.com/security/data/fix/linux/alsa-2026-64788.md) | Sep 8, 2026 | almalinux 10 3.7.1-5.el10_2.7 | High | 3 | 0 |
| [ELSA-2026-64788-0](https://patchblox.com/security/data/fix/linux/elsa-2026-64788-0.md) | Sep 8, 2026 | ol 10 0:3.7.1-5.el10_2.7 | High | 3 | 0 |
| [SUSE-SU-2026:3801-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3801-1.md) | Aug 25, 2026 | sles 15.6 3.7.1-150600.13.6.1 | High | 1 | 0 |
| [SUSE-SU-2026:3801-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3801-1.md) | Aug 25, 2026 | sles 15.7 3.7.1-150600.13.6.1 | High | 1 | 0 |
| [OPENSUSE-SU-2026:21621-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21621-1.md) | Aug 21, 2026 | opensuse-leap 16.0 3.7.1-bp160.1.1 | High | 2 | 0 |
| [ELSA-2026-30855](https://patchblox.com/security/data/fix/linux/elsa-2026-30855.md) | Jul 22, 2026 | ol 10 0:3.7.1-5.el10_2.6 | Urgent | 1 | 0 |
| [ELSA-2026-19133](https://patchblox.com/security/data/fix/linux/elsa-2026-19133.md) | Jul 21, 2026 | ol 10 0:3.7.1-5.el10_2.6 | High | 3 | 0 |
| [RHSA-2026:39319](https://patchblox.com/security/data/fix/linux/rhsa-2026-39319.md) | Jul 18, 2026 | RHEL 9 0:3.7.1-4.el9_8.2 | High | 1 | 0 |
| [RHSA-2026:39266](https://patchblox.com/security/data/fix/linux/rhsa-2026-39266.md) | Jul 18, 2026 | RHEL 8 0:3.4.1-12.el8_10 | High | 1 | 0 |
| [ELSA-2026-39272](https://patchblox.com/security/data/fix/linux/elsa-2026-39272.md) | Jul 16, 2026 | ol 10 0:3.7.1-5.el10_2.6 | High | 1 | 0 |
| [RLSA-2026:39272](https://patchblox.com/security/data/fix/linux/rlsa-2026-39272.md) | Jul 15, 2026 | rocky 10 0:3.7.1-5.el10_2.6 | High | 1 | 0 |
| [RLSA-2026:39319](https://patchblox.com/security/data/fix/linux/rlsa-2026-39319.md) | Jul 15, 2026 | rocky 9 0:3.7.1-4.el9_8.2 | High | 1 | 0 |
| [RLSA-2026:39266](https://patchblox.com/security/data/fix/linux/rlsa-2026-39266.md) | Jul 15, 2026 | rocky 8 0:3.4.1-12.el8_10 | High | 1 | 0 |
| [ALSA-2026:39266](https://patchblox.com/security/data/fix/linux/alsa-2026-39266.md) | Jul 14, 2026 | almalinux 8 3.4.1-12.el8_10 | High | 1 | 0 |
| [ALSA-2026:39272](https://patchblox.com/security/data/fix/linux/alsa-2026-39272.md) | Jul 14, 2026 | almalinux 10 3.7.1-5.el10_2.6 | High | 1 | 0 |
| [ALSA-2026:39319](https://patchblox.com/security/data/fix/linux/alsa-2026-39319.md) | Jul 14, 2026 | almalinux 9 3.7.1-4.el9_8.2 | High | 1 | 0 |
| [ELSA-2026-39266](https://patchblox.com/security/data/fix/linux/elsa-2026-39266.md) | Jul 14, 2026 | ol 8 0:3.4.1-12.el8_10 | High | 1 | 0 |
| [ELSA-2026-39319](https://patchblox.com/security/data/fix/linux/elsa-2026-39319.md) | Jul 14, 2026 | ol 9 0:3.7.1-4.el9_8.2 | High | 1 | 0 |
| [RLSA-2026:30855](https://patchblox.com/security/data/fix/linux/rlsa-2026-30855.md) | Jul 5, 2026 | rocky 10 0:3.7.1-5.el10_2.5 | Urgent | 1 | 0 |
| [RLSA-2026:30854](https://patchblox.com/security/data/fix/linux/rlsa-2026-30854.md) | Jul 1, 2026 | rocky 9 0:3.7.1-4.el9_8.1 | Urgent | 1 | 0 |
| [RLSA-2026:30853](https://patchblox.com/security/data/fix/linux/rlsa-2026-30853.md) | Jul 1, 2026 | rocky 8 0:3.4.1-11.el8_10 | Urgent | 1 | 0 |
| [RHSA-2026:67149](https://patchblox.com/security/data/fix/linux/rhsa-2026-67149.md) | Jun 30, 2026 | RHEL 10 3.6.1-2.el10_0.7 | Urgent | 7 | 0 |
| [RHSA-2026:30854](https://patchblox.com/security/data/fix/linux/rhsa-2026-30854.md) | Jun 29, 2026 | RHEL 9 0:3.7.1-4.el9_8.1 | Urgent | 1 | 0 |
| [RHSA-2026:30853](https://patchblox.com/security/data/fix/linux/rhsa-2026-30853.md) | Jun 29, 2026 | RHEL 8 0:3.4.1-11.el8_10 | Urgent | 1 | 0 |
| [ALSA-2026:30853](https://patchblox.com/security/data/fix/linux/alsa-2026-30853.md) | Jun 29, 2026 | almalinux 8 3.4.1-11.el8_10 | Urgent | 1 | 0 |
| [ALSA-2026:30854](https://patchblox.com/security/data/fix/linux/alsa-2026-30854.md) | Jun 29, 2026 | almalinux 9 3.7.1-4.el9_8.1 | Urgent | 1 | 0 |
| [ALSA-2026:30855](https://patchblox.com/security/data/fix/linux/alsa-2026-30855.md) | Jun 29, 2026 | almalinux 10 3.7.1-5.el10_2.5 | Urgent | 1 | 0 |
| [ELSA-2026-30853](https://patchblox.com/security/data/fix/linux/elsa-2026-30853.md) | Jun 29, 2026 | ol 8 0:3.4.1-11.el8_10 | Urgent | 1 | 0 |
| [ELSA-2026-30854](https://patchblox.com/security/data/fix/linux/elsa-2026-30854.md) | Jun 29, 2026 | ol 9 0:3.7.1-4.el9_8.1 | Urgent | 1 | 0 |
| [ALAS2023-2026-1889](https://patchblox.com/security/data/fix/linux/alas2023-2026-1889.md) | Jun 22, 2026 | amzn 2023 3.7.1-81.amzn2023 | Routine | 1 | 0 |
| [RLSA-2026:19133](https://patchblox.com/security/data/fix/linux/rlsa-2026-19133.md) | May 29, 2026 | rocky 10 0:3.7.1-4.el10_2 | High | 4 | 0 |
| [RLSA-2026:19350](https://patchblox.com/security/data/fix/linux/rlsa-2026-19350.md) | May 28, 2026 | rocky 9 0:3.7.1-4.el9_8 | High | 4 | 0 |
| [ALAS2023-2026-1722](https://patchblox.com/security/data/fix/linux/alas2023-2026-1722.md) | May 25, 2026 | amzn 2023 3.7.1-80.amzn2023 | High | 6 | 0 |
| [ALSA-2026:19350](https://patchblox.com/security/data/fix/linux/alsa-2026-19350.md) | May 19, 2026 | almalinux 9 3.7.1-4.el9_8 | High | 9 | 0 |
| [ALSA-2026:19133](https://patchblox.com/security/data/fix/linux/alsa-2026-19133.md) | May 19, 2026 | almalinux 10 3.7.1-4.el10_2 | High | 4 | 0 |
| [RHSA-2026:19350](https://patchblox.com/security/data/fix/linux/rhsa-2026-19350.md) | May 15, 2026 | RHEL 9 0:3.7.1-4.el9_8 | High | 8 | 0 |
| [RHSA-2026:16875](https://patchblox.com/security/data/fix/linux/rhsa-2026-16875.md) | May 15, 2026 | RHEL 8 0:3.4.1-10.el8_10 | High | 4 | 0 |
| [RLSA-2026:16875](https://patchblox.com/security/data/fix/linux/rlsa-2026-16875.md) | May 14, 2026 | rocky 8 0:3.4.1-10.el8_10 | High | 4 | 0 |
| [ALSA-2026:16875](https://patchblox.com/security/data/fix/linux/alsa-2026-16875.md) | May 13, 2026 | almalinux 8 3.4.1-10.el8_10 | High | 4 | 0 |
| [ELSA-2026-16875](https://patchblox.com/security/data/fix/linux/elsa-2026-16875.md) | May 13, 2026 | ol 8 0:3.4.1-10.el8_10 | High | 4 | 0 |
| [ELSA-2026-14200](https://patchblox.com/security/data/fix/linux/elsa-2026-14200.md) | May 6, 2026 | ol 9 0:3.6.1-8.el9_7.1 | High | 3 | 0 |
| [RHSA-2026:7259](https://patchblox.com/security/data/fix/linux/rhsa-2026-7259.md) | Apr 15, 2026 | RHEL 9 0:3.6.1-8.el9_7 | High | 1 | 0 |
| [ELSA-2026-7259](https://patchblox.com/security/data/fix/linux/elsa-2026-7259.md) | Apr 9, 2026 | ol 9 0:3.6.1-8.el9_7 | High | 1 | 0 |
| [RHSA-2026:19715](https://patchblox.com/security/data/fix/linux/rhsa-2026-19715.md) | Apr 8, 2026 | RHEL 10 3.6.1-2.el10_0.4 | High | 3 | 0 |
| [ELSA-2026-7005](https://patchblox.com/security/data/fix/linux/elsa-2026-7005.md) | Apr 8, 2026 | ol 10 0:3.6.1-8.el10_1 | High | 1 | 0 |
| [RHSA-2026:3928](https://patchblox.com/security/data/fix/linux/rhsa-2026-3928.md) | Mar 12, 2026 | RHEL 9 0:3.6.1-7.el9_7 | High | 3 | 0 |
| [RHSA-2026:3985](https://patchblox.com/security/data/fix/linux/rhsa-2026-3985.md) | Mar 12, 2026 | RHEL 8 0:3.4.1-8.el8_10 | High | 2 | 0 |
| [RLSA-2026:4164](https://patchblox.com/security/data/fix/linux/rlsa-2026-4164.md) | Mar 11, 2026 | rocky 10 0:3.6.1-7.el10_1 | High | 3 | 0 |
| [RLSA-2026:3985](https://patchblox.com/security/data/fix/linux/rlsa-2026-3985.md) | Mar 10, 2026 | rocky 8 0:3.4.1-8.el8_10 | High | 2 | 0 |
| [ALSA-2026:4164](https://patchblox.com/security/data/fix/linux/alsa-2026-4164.md) | Mar 10, 2026 | almalinux 10 3.6.1-7.el10_1 | High | 3 | 0 |
| [ELSA-2026-4164](https://patchblox.com/security/data/fix/linux/elsa-2026-4164.md) | Mar 10, 2026 | ol 10 0:3.6.1-7.el10_1 | High | 3 | 0 |
| [ALSA-2026:3985](https://patchblox.com/security/data/fix/linux/alsa-2026-3985.md) | Mar 9, 2026 | almalinux 8 3.4.1-8.el8_10 | High | 2 | 0 |
| [ELSA-2026-3985](https://patchblox.com/security/data/fix/linux/elsa-2026-3985.md) | Mar 9, 2026 | ol 8 0:3.4.1-8.el8_10 | High | 2 | 0 |
| [RHSA-2026:9435](https://patchblox.com/security/data/fix/linux/rhsa-2026-9435.md) | Mar 6, 2026 | RHEL 10 3.6.1-2.el10_0.3 | High | 1 | 0 |
| [RLSA-2026:3928](https://patchblox.com/security/data/fix/linux/rlsa-2026-3928.md) | Mar 6, 2026 | rocky 9 0:3.6.1-7.el9_7 | High | 3 | 0 |
| [ALSA-2026:3928](https://patchblox.com/security/data/fix/linux/alsa-2026-3928.md) | Mar 5, 2026 | almalinux 9 3.6.1-7.el9_7 | High | 3 | 0 |
| [ELSA-2026-3928](https://patchblox.com/security/data/fix/linux/elsa-2026-3928.md) | Mar 5, 2026 | ol 9 0:3.6.1-7.el9_7 | High | 3 | 0 |
| [RLSA-2026:2323](https://patchblox.com/security/data/fix/linux/rlsa-2026-2323.md) | Feb 11, 2026 | rocky 8 0:3.4.1-7.el8_10 | High | 1 | 0 |
| [ALSA-2026:2323](https://patchblox.com/security/data/fix/linux/alsa-2026-2323.md) | Feb 9, 2026 | almalinux 8 3.4.1-7.el8_10 | High | 1 | 0 |
| [ELSA-2026-2323](https://patchblox.com/security/data/fix/linux/elsa-2026-2323.md) | Feb 9, 2026 | ol 8 0:3.4.1-7.el8_10 | High | 1 | 0 |
| [RHSA-2026:2323](https://patchblox.com/security/data/fix/linux/rhsa-2026-2323.md) | Feb 9, 2026 | RHEL 8 0:3.4.1-7.el8_10 | High | 1 | 0 |
| [RHSA-2026:4166](https://patchblox.com/security/data/fix/linux/rhsa-2026-4166.md) | Feb 5, 2026 | RHEL 10 3.6.1-2.el10_0.2 | High | 3 | 0 |
| [RHSA-2025:23744](https://patchblox.com/security/data/fix/linux/rhsa-2025-23744.md) | Jan 16, 2026 | RHEL 9 0:3.6.1-4.el9_7 | High | 1 | 0 |
| [RHSA-2025:23745](https://patchblox.com/security/data/fix/linux/rhsa-2025-23745.md) | Jan 16, 2026 | RHEL 8 0:3.4.1-6.el8_10 | High | 1 | 0 |
| [RLSA-2025:23744](https://patchblox.com/security/data/fix/linux/rlsa-2025-23744.md) | Dec 23, 2025 | rocky 9 0:3.6.1-4.el9_7 | High | 1 | 0 |
| [RLSA-2025:23745](https://patchblox.com/security/data/fix/linux/rlsa-2025-23745.md) | Dec 23, 2025 | rocky 8 0:3.4.1-6.el8_10 | High | 1 | 0 |
| [ALSA-2025:23744](https://patchblox.com/security/data/fix/linux/alsa-2025-23744.md) | Dec 22, 2025 | almalinux 9 3.6.1-4.el9_7 | High | 1 | 0 |
| [ALSA-2025:23745](https://patchblox.com/security/data/fix/linux/alsa-2025-23745.md) | Dec 22, 2025 | almalinux 8 3.4.1-6.el8_10 | High | 1 | 0 |
| [ELSA-2025-23744](https://patchblox.com/security/data/fix/linux/elsa-2025-23744.md) | Dec 21, 2025 | ol 9 0:3.6.1-4.el9_7 | High | 1 | 0 |
| [ELSA-2025-23745](https://patchblox.com/security/data/fix/linux/elsa-2025-23745.md) | Dec 21, 2025 | ol 8 0:3.4.1-6.el8_10 | High | 1 | 0 |
| [RLSA-2025:23667](https://patchblox.com/security/data/fix/linux/rlsa-2025-23667.md) | Dec 20, 2025 | rocky 10 0:3.6.1-4.el10_1 | High | 1 | 0 |
| [ALSA-2025:23667](https://patchblox.com/security/data/fix/linux/alsa-2025-23667.md) | Dec 18, 2025 | almalinux 10 3.6.1-4.el10_1 | High | 1 | 0 |
| [ELSA-2025-23667](https://patchblox.com/security/data/fix/linux/elsa-2025-23667.md) | Dec 18, 2025 | ol 10 0:3.6.1-4.el10_1 | High | 1 | 0 |
| [ALAS2023-2025-1258](https://patchblox.com/security/data/fix/linux/alas2023-2025-1258.md) | Nov 10, 2025 | amzn 2023 3.7.1-79.amzn2023 | High | 3 | 0 |
| [DEBIAN-CVE-2025-26625](https://patchblox.com/security/data/fix/linux/debian-cve-2025-26625.md) | Oct 17, 2025 | Debian 12.15 (bookworm) 3.3.0-1+deb12u2 | High | 1 | 0 |
| [DEBIAN-CVE-2025-26625](https://patchblox.com/security/data/fix/linux/debian-cve-2025-26625.md) | Oct 17, 2025 | Debian 14 3.7.1-1 | High | 1 | 0 |
| [DEBIAN-CVE-2025-26625](https://patchblox.com/security/data/fix/linux/debian-cve-2025-26625.md) | Oct 17, 2025 | Debian 13.5 (trixie) 3.6.1-1+deb13u1 | High | 1 | 0 |
| [RHSA-2026:0224](https://patchblox.com/security/data/fix/linux/rhsa-2026-0224.md) | Oct 17, 2025 | RHEL 10 3.6.1-2.el10_0.1 | High | 1 | 0 |
| [git-lfs 3.4.1-1ubuntu0.3+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-git-lfs-3.4.1-1ubuntu0.3-esm2.md) | Oct 17, 2025 | Ubuntu 24.04.5 LTS (noble) 3.4.1-1ubuntu0.3+esm2 | High | 2 | 0 |
| [git-lfs 3.6.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-git-lfs-3.6.1-1ubuntu0.1.md) | Oct 17, 2025 | Ubuntu 25.10 (questing) 3.6.1-1ubuntu0.1 | High | 1 | 0 |
| [RLSA-2025:7256](https://patchblox.com/security/data/fix/linux/rlsa-2025-7256.md) | Oct 4, 2025 | rocky 9 0:3.6.1-1.el9 | High | 6 | 0 |
| [RLSA-2025:9106](https://patchblox.com/security/data/fix/linux/rlsa-2025-9106.md) | Oct 4, 2025 | rocky 9 0:3.6.1-2.el9_6 | High | 1 | 0 |
| [RLSA-2025:9063](https://patchblox.com/security/data/fix/linux/rlsa-2025-9063.md) | Oct 3, 2025 | rocky 10 0:3.6.1-2.el10_0 | High | 1 | 0 |
| [SUSE-SU-2025:03012-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03012-1.md) | Aug 29, 2025 | sles 15.7 3.7.0-150600.13.3.1 | Patch now | 5 | 1 |
| [SUSE-SU-2025:03012-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03012-1.md) | Aug 29, 2025 | sles 15.6 3.7.0-150600.13.3.1 | Patch now | 5 | 1 |
| [SUSE-SU-2025:03012-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03012-1.md) | Aug 29, 2025 | opensuse-leap 15.6 3.7.0-150600.13.3.1 | Patch now | 5 | 1 |
| [RLSA-2025:9060](https://patchblox.com/security/data/fix/linux/rlsa-2025-9060.md) | Jul 29, 2025 | rocky 8 0:3.4.1-5.el8_10 | High | 1 | 0 |
| [ELSA-2025-9063](https://patchblox.com/security/data/fix/linux/elsa-2025-9063.md) | Jun 26, 2025 | ol 10 0:3.6.1-2.el10_0 | High | 1 | 0 |
| [ALSA-2025:9060](https://patchblox.com/security/data/fix/linux/alsa-2025-9060.md) | Jun 16, 2025 | almalinux 8 3.4.1-5.el8_10 | High | 1 | 0 |

Showing the newest 100 of 156 fixes.

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.