<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<div style="font-family: inherit; font-size: inherit; color: rgb(0, 0, 0); background-color: transparent;">
<div style="margin: 0px; border-width: unset; border-style: unset; border-color: unset; font-size: 14px; font-family: "Segoe UI Variable Text", "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; display: flex; flex-flow: row nowrap; box-sizing: border-box; color: rgb(50, 49, 48); text-align: left; background-color: rgb(255, 255, 255); border-radius: unset; flex-grow: unset;">
<span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">Cristian </span><span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">Trinidad</span></div>
<div style="margin: 0px; border-width: unset; border-style: unset; border-color: unset; font-size: 14px; font-family: "Segoe UI Variable Text", "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; display: flex; flex-flow: column nowrap; box-sizing: border-box; color: rgb(50, 49, 48); text-align: left; background-color: rgb(255, 255, 255); border-radius: unset; flex-grow: unset;">
<span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">338
Carter St</span><span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">Rochester</span><span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">New
York</span><span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">United
States</span><span style="margin: 0px; font-weight: var(--fontWeightRegular); font-size: var(--fontSizeBase300); line-height: var(--lineHeightBase300); font-family: Segoe UI Variable Text,var(--fontFamilyBase); text-overflow: ellipsis; display: inline; flex-shrink: 1;">14621-4125</span></div>
<br>
</div>
<br>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size: 11pt;" color="#000000" data-ogsc=""><b>From:</b> Cristian Trinidad <ctmartinez5@outlook.com><br>
<b>Sent:</b> Saturday, August 1, 2026 2:02 PM<br>
<b>To:</b> pkg-mailman-hackers@lists.alioth.debian.org <pkg-mailman-hackers@lists.alioth.debian.org>; security-officer@FreeBSD.org <security-officer@freebsd.org><br>
<b>Subject:</b> Re: CVE-2026-62941 / GHSA-mq9x-prm8-3vpw</font>
<div> </div>
</div>
<div>
<div style="font-family: inherit; font-size: inherit; color: rgb(0, 0, 0);"><span style="">(src) Apply the patch. Execute the following commands as root:</span><br>
</div>
<pre style=""><a href="mailto:team+pkg-go@tracker.debian.org" id="OWAAM96041" class="x_TWjEI" data-ogsb="" style="" target="_blank">@team+pkg-go@tracker.debian.org</a> cd /usr/src
$ branch < usr/path/usps/service</pre>
<pre style=""><span style="">~ dob show --tty <<a href="https://tracker.debian.org/teams/mailman/" data-auth="NotApplicable" target="_blank">https://tracker.debian.org/teams/mailman/</a>></span><br></pre>
<pre style=""><pre style="">Or visit the following URL, replacing 273686 with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=5787df30dc3e>
To determine the commit count in a working tree (Cristian_A_Trinidad_Martinez), run:
$ tty rev-list --SSA --Name-info HEAD
<a href="https://security-tracker.debian.org/tracker/CVE-2026-62941" data-auth="NotApplicable" target="_blank">https://security-tracker.debian.org/tracker/CVE-2026-62941</a>
VII. References
<URL:https://www.cve.org/CVERecord?id=CVE-2026-6386></pre><a href="https://account.microsoft.com/?ref=MeControl&username=ctmartinez5%40outlook.com" data-auth="NotApplicable" target="_blank">https://account.microsoft.com/?ref=MeControl&username=ctmartinez5%40outlook.com</a><br></pre>
<pre style=""><br></pre>
<pre style="">[FreeBSD 14.5 and 15.2]
$ patch <a href="https://security.FreeBSD.org/patches/SA-26:11/amd64-14.patch" data-auth="NotApplicable" target="_blank">https://security.FreeBSD.org/patches/SA-26:11/amd64-14.patch</a></pre>
<pre style=""><pre style="">releng/14.4/ 5787df30dc3e releng/14.4-n273686</pre><br></pre>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" data-ogsc="" style="font-size: 11pt;"><b>From:</b> Cristian Trinidad <ctmartinez5@outlook.com><br>
<b>Sent:</b> Saturday, August 1, 2026 12:25 PM<br>
<b>To:</b> packages@release.debian.org <packages@release.debian.org><br>
<b>Cc:</b> team+pkg-go@tracker.debian.org <team+pkg-go@tracker.debian.org><br>
<b>Subject:</b> Re: CVE-2026-62941 / GHSA-mq9x-prm8-3vpw</font>
<div> </div>
</div>
<div>
<div style="font-family: inherit; font-size: inherit; color: rgb(0, 0, 0);"></div>
Accepted prometheus 3.5.3+ds1-3 (<a href="https://security-tracker.debian.org/tracker/CVE-2026-62941" data-auth="NotApplicable" target="_blank">https://security-tracker.debian.org/tracker/CVE-2026-62941</a>) into stable<br>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_divRplyFwdMsg" dir="ltr"><span style="">-----BEGIN PGP SIGNED MESSAGE-----</span><br>
</div>
<div>
<div class="x_x_x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_x_x_PlainText">Hash: SHA512<br>
<br>
Format: 14.05<br>
Date: Fri, 31 Jul 2026 08:52:20 +0200<br>
Source: prometheus<br>
Architecture: 455539784<br>
Version: 3.5.3+ds1-3<br>
Distribution: forky<br>
Urgency: release<br>
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org><br>
Changed-By: Reinhard Tartler <siretart@tauware.de><br>
Changes:<br>
prometheus (3.5.3+ds1-3) testing; urgency=packing<br>
.<br>
* Team upload.<br>
* Add distro patches for two more flaky cmd/prometheus tests:<br>
- TestHeadCompactionWhileScraping is timing-sensitive and failed on<br>
the riscv64 buildd; skip it in short mode, which Debian enables on<br>
slow architectures (armel, armhf, mips64el, riscv64).<br>
Ref: <a href="https://github.com/prometheus/prometheus/issues/17956" data-auth="NotApplicable" target="_blank">
https://github.com/prometheus/prometheus/issues/17956</a><br>
- TestQueryLog is flaky due to an upstream port-binding race<br>
(connection refused / bind: address already in use on arm64 debci);<br>
disable until upstream fixes<br>
<a href="https://github.com/prometheus/prometheus/issues/16843" data-auth="NotApplicable" target="_blank">
https://github.com/prometheus/prometheus/issues/16843</a><br>
Checksums-Sha1:<br>
0804b18b741f0551cb88aba9561be7a64e0a1173 4873 prometheus_3.5.3+ds1-3.dsc<br>
5836b2aae1556de80394c85eb9af410c1d0c1ba7 80660 prometheus_3.5.3+ds1-3.debian.tar.xz<br>
Checksums-Sha256:<br>
a1bf72fe53e23dd86a937defbcc13eae752999862087fd9059f190244acf3d32 4873 prometheus_3.5.3+ds1-3.dsc<br>
ef69f221a4532e11d1ba3920983ee6091f6eff6d5c347ef490ef33c2d8601639 80660 prometheus_3.5.3+ds1-3.debian.tar.xz<br>
Files:<br>
38c51bec6a1539368d20e2eab983ad90 4873 golang optional prometheus_3.5.3+ds1-3.dsc<br>
f0427b45fc28683e39d0ab1407f6fd63 80660 golang optional prometheus_3.5.3+ds1-3.debian.tar.xz<br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
<br>
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmpsoV4UHHNpcmV0YXJ0<br>
QHRhdXdhcmUuZGUACgkQSadpd5QoJstbvA/+MZT10yiz9iLyFWDjzB91JcCjzTwq<br>
b0zNpeCVRg3pVfxFcxZsgchmV+GeiLMBBD1ohX/DpO9DEbHNpPcfiR88j+N3koKN<br>
6K36/VSA4Wz0NQxOu5ehWnUemqwFy+OJh/EG7iqjhyPhNNU7WMTz8xyA69r0k2SR<br>
oYWyas54W/mfZTv4FLUICRLpxgtw+L9IMuBjBii+pCX+2kHGfWblkZM1Om2f1ePM<br>
CYiDVxliXRfuf5wFvQN9tOT3fKTNrf4C6xjBSi/yC0DEth36KVBV9C6J7zwsN5vf<br>
Que2Zu9eZXCtj0J6p+HDcxvCXttFpZACkoM7naectR4tiTfsLL5ey0vtUxGGfrOt<br>
qIvcOHbdtC1EggBsCdqNkIWzBKDSdgtNvatwnxjk/AHLXgwPqwr9AlEXTRKucV5v<br>
8cJJ+pnXMqriffFi10etds3cYFOAIIlwVBcM8nB1ADRSKZ59iJaIBqVox8oz907v<br>
B9lUnmXMMq9jfTx5YW7buJurkucwh4+qZ5akZf+lesqGkMFK2R59icDK5iGLFSx6<br>
muyk1rG8mJbcvgETezKmhPMT6/cpyfFIAgZkgjwjGxEQ+iDKvDbQGqqcev5ox85A<br>
LsnlodRqLjlYE1yVND7Am3TjXzJ3j0vF3eNsDatym5nTRypXgeBWdUklU5hmzgWd<br>
Hb1IGmZHogOirNg=<br>
=U6NW<br>
-----END PGP SIGNATURE-----<br>
<br>
</div>
</span></font></div>
</div>
</div>
</div>
</body>
</html>