<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Michael Tokarev pushed to branch debian/4.23 at <a href="https://salsa.debian.org/samba-team/samba">Debian Samba Team / samba</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/8deb76b057ceaeee8c6dae3f9cdd74a6a8c4645b">8deb76b0</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-02-27T10:20:06+01:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Bump version up to Samba 4.23.7...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/4d57a9108b570db60f630c5e57dce70cb55dae7d">4d57a910</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-04-14T13:20:17+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>rpc: Don't offer spoolss RPC with "disable spoolss = yes"
Bug: https://bugzilla.samba.org/show_bug.cgi?id=16019
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Fri Mar 13 09:00:05 UTC 2026 on atb-devel-224
(cherry picked from commit 8497fb05d8d9c082b7ba318844970f0b3227aff9)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f77538237e5a580f173b74ff247579d53e8775c3">f7753823</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-14T13:20:17+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>wafsamba: Add -D_FORTIFY_SOURCE=3 when stack protector is enabled
The capability check in SAMBA_CONFIG_H() already tests that the compiler
accepts both -Wp,-D_FORTIFY_SOURCE and the stack protector flag
together, but only the stack protector flag was added to EXTRA_CFLAGS on
success.
The glibc normally silently downgrades to the supported level if the on
specified is not supported.
Note that -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 only sets it if not
already defined.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16040
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Mar 27 08:33:09 UTC 2026 on atb-devel-224
(cherry picked from commit 333ac047c3fc151222e5ee6aaa75452276b0031e)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/83ad6bad9f205963da6132728bd6c56b0e16bab4">83ad6bad</a></strong>
<div>
<span> by Noel Power </span> <i> at 2026-04-14T13:20:17+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3/librpc/crypto: Don't keep growing in memory keytab
When we have long living concurrent connections every rpc bind
ends up calling and subsequently adding keytab entries to the
memory keytab returned by 'gse_krb5_get_server_keytab(...)'. This is
happening because as long as there is a handle open for the
keytab named "MEMORY:cifs_srv_keytab" then we keep adding entries to
it.
Note: There is no leak of gensec_security nor the krb5_keytab
it contains. When rpc clients connected to the rpc worker process
exit the gensec_security and the krb5_keytab structures are
destructed as expected. However because we use a fixed name
"MEMORY:cifs_srv_keytab" clients end up with a handle to a
reference counted shared keytab. Destruction of the keytab results
in the associated reference count being decremented. When the
reference count reaches 0 the keytab is destroyed.
To avoid the keytab being extended the easiest solution is to ensure a
unique memory keytab is created for each client.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16042
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Noel Power <npower@samba.org>
Autobuild-Date(master): Mon Mar 30 09:36:45 UTC 2026 on atb-devel-224
(cherry picked from commit c28a86c45d9d9673de18f9c29ea80dff12c9e7dd)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/490f6ed1675ff7c66cd47eba9b086baedc996e78">490f6ed1</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-04-14T14:22:35+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>samba_cross.py: autobuild fails with trailing space at line endings
autobuild fails with trailing space at line endings, so we need to strip() only
at "\n" here strictly.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16057
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Apr 10 21:20:52 UTC 2026 on atb-devel-224
(cherry picked from commit 2f8dfde1210395175e726455bdb63a7b97245a72)
Autobuild-User(v4-23-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-23-test): Tue Apr 14 14:22:35 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/494e8b66e74df2c8393b0367aa1b36e84b204889">494e8b66</a></strong>
<div>
<span> by Noel Power </span> <i> at 2026-04-16T10:45:13+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3/modules: Fix vfs snapper not finding files in subdirs
when trying to browse on windows a snapper share (exposed via windows previous versions) files in subdirs are not visible. In other words only files that are in the root dir of the versioned share can be seen
/ashare/file1
/ashare/file2
/ashare/subdir
/ashare/subdir/subfile1
For example with the file hierarchy above only file1, file2 and subdir are visible. Navigating into subdir shows an empty dir
snapper_gmt_openat is failing because when calling snapper_gmt_convert
it doesn't take into account the path to the subdirectory.
snapper_gmt_convert is just passed the leaf name where it constructs the
snapper path based on the base dir of the share.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16058
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
(cherry picked from commit f45b832a17a82a394076476d809b274ddbd720b0)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/9fc56116cf387fac89e6894866434ca0e2fe9f0e">9fc56116</a></strong>
<div>
<span> by Noel Power </span> <i> at 2026-04-16T11:47:43+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3/modules: fix snapper_gmt_fstatat
snapper_gmt_fstatat is failing when called on items in a
'previous version' snapshot because the wrong timestamp value is
passed (the raw timewarp value is used) and snapper_gmt_convert cannot
find the valid snapshot instance to use.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16058
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Wed Apr 15 15:29:38 UTC 2026 on atb-devel-224
(cherry picked from commit 78b7ed68e8da0c95ddc60fac58a6821ab723865b)
Autobuild-User(v4-23-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-23-test): Thu Apr 16 11:47:43 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/cc3e9f0167b0cd1118f2536b39553bd23a74cff3">cc3e9f01</a></strong>
<div>
<span> by Thales Antunes de Oliveira Barretto </span> <i> at 2026-04-20T14:06:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>vfs_glusterfs: fix directory fd leak via FSP extension destructor
When Samba closes a directory backed by vfs_glusterfs, the glfs_fd_t
opened by vfs_gluster_openat() is never closed. This leaks one
libgfapi file descriptor and one server-side fd_t in glusterfsd per
directory open/close cycle. With persistent SMB2 connections the
leak is unbounded and drives monotonic RSS growth on the GlusterFS
brick process.
The leak happens because vfs_glusterfs creates two independent
glfs_fd_t handles per directory: one via glfs_open() in
vfs_gluster_openat(), stored in the FSP extension, and another via
glfs_opendir() in vfs_gluster_fdopendir(), tracked by struct smb_Dir.
On close, smb_Dir_destructor() closes the opendir handle and sets the
pathref fd to -1. fd_close() then returns early without calling
SMB_VFS_CLOSE, so vfs_gluster_close() never runs and the glfs_open()
handle is orphaned. The original code passed NULL as the destroy
callback to VFS_ADD_FSP_EXTENSION, so there was no safety net.
The default VFS does not have this problem because fdopendir(3) wraps
the existing kernel fd rather than opening a new handle. libgfapi
has no equivalent -- glfs_opendir() always creates an independent
handle by path. The actual glfs_fd_t is stored in the FSP extension,
not in fsp->fh->fd (which holds a sentinel value), so Samba's generic
close path cannot reach it.
Register vfs_gluster_fsp_ext_destroy() as the FSP extension destroy
callback. It calls glfs_close() on the stored pointer and is invoked
by vfs_remove_all_fsp_extensions() during file_free(), which runs
unconditionally for every fsp. In the explicit close path,
vfs_gluster_close() NULLs the extension pointer before calling
VFS_REMOVE_FSP_EXTENSION to prevent double-close. This follows the
same pattern used by vfs_ceph_new.c (vfs_ceph_fsp_ext_destroy_cb).
Observed on a production file server with persistent SMB2 connections
and continuous directory operations. GlusterFS brick statedumps
showed fd_t pool growth from 1,993 to 80,350 active instances over
6 days, roughly 13,000 leaked fds per day per brick.
RN: Fix a directory file descriptor leak in vfs_glusterfs that caused
unbounded memory growth on the GlusterFS brick with persistent SMB2
connections.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16043
Signed-off-by: Thales Antunes de Oliveira Barretto <thales.barretto.git@gmail.com>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Apr 8 16:46:12 UTC 2026 on atb-devel-224
(cherry picked from commit e7c1c49e647adeaf2c6dda0d42f48305c0a5bc58)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/e3175487313d8a5ae374f8a24efa4a6e786e0147">e3175487</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-20T14:06:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3:libsmb: Add a talloc context to the internal data structure
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
(cherry picked from commit 959ea545fbd899dba14dc1216b8f4dca8cdb9b52)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/7bded2db88498d4dd8be339437ac6e6f7d5ee32c">7bded2db</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-20T14:06:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>selftest: Add some hardlinks for testing SMB3 posix extensions
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15960
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 3a5826d2facf140e610ca08cc80340c7aa5cf96a)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/b745256e658d4959579310345fdde6f358f687bb">b745256e</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-20T14:06:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s4:torture: Implement posix extension tests for libsmbclient
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15960
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit e6e1cd753509698766de46df29c490fae5fcde9d)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/c3a6f0a9c0f8358ac743225b8bbdf796b729d516">c3a6f0a9</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-20T14:06:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>libsmbclient: Fix negotiating posix_extensions
Without this, smbc_setOptionPosixExtensions() does nothing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15960
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 8c276ff55efd3577e2a141613190231eefb8063f)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/11368c3ecfc7d1ba27d0f1b175ac526c24796c38">11368c3e</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-20T14:06:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3:libsmb: Call the correct function in smbc_fgetxattr()
Looks like nobody ever tested this.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15960
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 1b5e40ef37eacaf2598401b43c1e9944e88a2308)
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f5baf08ec62c83b7a9d08070b05ae568168e022e">f5baf08e</a></strong>
<div>
<span> by Andreas Schneider </span> <i> at 2026-04-20T15:06:30+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>s3:include: Fix the smbc_fgetxattr() documentation in libsmbclient
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15960
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Dec 9 19:33:22 UTC 2025 on atb-devel-224
(cherry picked from commit 2493bfa84e48badb9e7e8460e16aea68f90f431b)
Autobuild-User(v4-23-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-23-test): Mon Apr 20 15:06:30 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/c42d7d192c9926ff6fd64b8d2aa8d10c18ad1854">c42d7d19</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-04-21T13:10:49+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>WHATSNEW: Add release notes for Samba 4.23.7.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/89de873fdaba0282f2423625e85ad80bbd24eb04">89de873f</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-04-21T13:12:07+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Disable GIT_SNAPSHOT for the 4.23.7 release.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/fc6ba3ecd245a8372599ac2a9e07533266a1e671">fc6ba3ec</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-04-21T13:36:33+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Bump version up to Samba 4.23.8...
and re-enable GIT_SNAPSHOT.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a74f1704beba04f85cc5c3e8301e49428239439c">a74f1704</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-04-21T15:20:56+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 4.23.7+dfsg</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/219a73876070b9314774af26f124831669b1ad9e">219a7387</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-04-21T15:21:30+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Update upstream source from tag 'upstream/4.23.7+dfsg'
Update to upstream version '4.23.7+dfsg'
with Debian dir a113058f6090baa16a4ab8bcff421dee6eafe21e</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/876123a57c3c740011c9220fea6809f03a61fe01">876123a5</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-04-21T15:23:31+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>update changelog; upload version 4.23.7+dfsg-1 to unstable
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/cbb4833caad37ca7337994e922304cd80ed1cca8">cbb4833c</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-04-27T12:59:57+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>third_party/ngtcp2: import v1.22.1 for CVE-2026-40170
For CVE-2026-40170 see:
https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16059
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 706dc118b3bdbe03ada53939c1634ab13c91455a)
Autobuild-User(v4-23-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-23-test): Mon Apr 27 12:59:57 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a7465333e8d54c71308835f9aadd96fcd3fbf849">a7465333</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-12T16:45:12+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>pam_winbind: only chown the home directory if it was created
Otherwise we may change the permission for '/'
if some systemuser (e.g. nobody) has no homedir and root
runs 'su - nobody'.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16073
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Bjoern Jacke <bjacke@samba.org>
Autobuild-User(master): Björn Jacke <bjacke@samba.org>
Autobuild-Date(master): Sun May 10 23:22:27 UTC 2026 on atb-devel-224
(cherry picked from commit 79caa6ef08b9b333e17bb0762e95e18e250db463)
Autobuild-User(v4-23-test): Björn Jacke <bjacke@samba.org>
Autobuild-Date(v4-23-test): Tue May 12 16:45:12 UTC 2026 on atb-devel-224
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/1eda6653fd2477d61ddcdf765d3f5aca47407fbf">1eda6653</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-05-15T14:33:41+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: re-enable GIT_SNAPSHOT
This should have been in commit
fc6ba3ecd245a8372599ac2a9e07533266a1e671.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/39856d437502dfd7e80ac2d6a1690e45b636056e">39856d43</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-1933: tests: Fix permissions used for creating reparse points
SEC_STD_ALL does not lead to fsp->access_mask to include the required
bits.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15992
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/7443fb5ad3f7efe4d9061320c29dbbfd636a41af">7443fb5a</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-1933: smbd: Add access checks to reparse point operations
On a share marked "read only = yes" and on file handles opened R/O
users can set or delete the reparse point xattrs on files that the
user has write-access in the file system for. Add the required access
checks.
Thanks to Asim Viladi Oglu Manizada for reporting the issue.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15992
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2531119024986bbc18f92d27c47b2d5c8a3b77ce">25311190</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-2340: test whether vfs_worm allows overwrite
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15997
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Volker Lendecke <vl@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/7962e74737f43749fd3c49ad9eb048dfd0b6d778">7962e747</a></strong>
<div>
<span> by Pavel Kohout </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-2340: vfs_worm: Check destination WORM status in rename
vfs_worm_renameat() only checked if the source file was WORM-protected,
but not the destination. This allowed overwriting immutable files via
SMB2 rename with ReplaceIfExists=1, bypassing WORM protection.
Add destination check using FSTATAT on the destination dirfsp, as
suggested by the maintainer.
CWE-284 (Improper Access Control)
Reported-by: Pavel Kohout, Aisle Research, www.aisle.com
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15997
To backport to 4.23 we change the name of dst_dirfsp and src_dirfsp to
dstfsp and srcfsp, respectively (accounting for
76796180cf3af3252db2c29d0e95282a498a8527 in 4.24/master).
Signed-off-by: Pavel Kohout <pavel.kohout@aisle.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/f040d9a3e30c00fd74e15f284ce5fc0ec6035303">f040d9a3</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-3012: gpo tests: fix test cleanup
These tests are going to fail soon but as currently written they do
not clean up after themselves, erroring instead of failing and causing
cascading errors in subsequent tests. For now we don't care to make
the other tests less fragile.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16003
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d77bf593c7e106ce9deefb92a424dc2930814b76">d77bf593</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-3012: do not fetch certificate over http
In the case where a certificate was found via HTTP, it was trusted
without verification and put in the global CA store.
There is no means to check the certificate other than by comparing it
to certificates we may have gathered via LDAP, but in that case there
is no advantage over just using the LDAP-derived certificates.
Using the LDAP certificates was already the fallback case if HTTP
failed, so we just make it the default.
The HTTP fetch depends on the NDES service, which is a variant of
Simple Certificate Enrolment Protocol (SCEP, RFC8894), but in fact
Samba implements none of that protocol other than the HTTP fetch. SCEP
is for clients that are not true domain members. Domain members can
access to certificates over LDAP. This patch is not reducing SCEP
client support because Samba never had it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16003
Reported-by: Arad Inbar, DREAM Security Research Team
Reported-by: Nir Somech, DREAM Security Research Team
Reported-by: Ben Grinberg, DREAM Security Research Team
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2b9d1982f9f9c6b418fa2c5fc44032463ed5f578">2b9d1982</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-3012: gp_auto_enrol: skip CAs not found in LDAP
If a certificate is mentioned in a GPO but is not present as a
cACertificate attribute on a pKIEnrollmentService object, we have no way
of obtaining it, so we might as well forget it.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16003
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2d8f4ac98d9768af12409948449b9804282cf8ec">2d8f4ac9</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-3012: gpo tests should use real certificates
Or at least, more real than a short arbitrary byte string, so that
the certificates can be parsed.
This shows that certificate enrolment works via LDAP in the situations
where we would have fetched them via HTTP.
This does not fix the advanced_gp_cert_auto_enroll_ext test which
wants to install certificates it has no access too. This will not be
fixed in the security release.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16003
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/9ac7c27d30997e180f9c88d93f0f6e76238eb42f">9ac7c27d</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-3238: winsserver4: Dissolve direct variable initialization
Checks are required before the packet is dereferenced
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16012
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2d7d92ef35e4496d43dd342c621b31f07d93fa71">2d7d92ef</a></strong>
<div>
<span> by Volker Lendecke </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-3238: winsserver4: Validate incoming packets
Avoid NULL pointer dereferences, leading to a crash in the nbt process
serving wins.
Thanks to Arad Inbar, Erez Cohen, Nir Somech and Ben Grinberg from
DREAM Security Research Team for pointing out this crash bug out to
the Samba team.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16012
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/df3455cf6d7e0f678de194941955ee0fde340287">df3455cf</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: inline string_sub2() into string_sub() the only caller
This will simplify further changes.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/db426990a137db31e6865bf3ae581ea3543c32a5">db426990</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: remove unused talloc_strdup(insert) from talloc_string_sub2()
The insert string is not modified, so we do not need to copy it.
This will simplify further changes.
Review with: git show --patience
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/fd5f6d69409ff1d4f99de9c8f1d2af16bb99971f">fd5f6d69</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: factor out a mask_unsafe_character() helper function
This moves the logic into a single place and
makes if more flexible to be used with more
values than STRING_SUB_UNSAFE_CHARACTERS.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/b54d65606c84b3da3ba83f53db71a69667402cf0">b54d6560</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: split out realloc_string_sub_raw()
This will allow realloc_string_sub2() to use it in order
to have the logic in one place only.
And it will also allow adjacted callers to be
more flexible.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/0c13febc7f40e512356afeea9e03d15de8ffba39">0c13febc</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:34+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: s3:lib: fix potential memory leak in talloc_sub_basic()
This makes the code easier to understand...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/9374f35a1be538f1330b9b6da2248e7a22810983">9374f35a</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: s3:lib: let realloc_string_sub2() use realloc_string_sub_raw()
We don't need this logic more than once!
But we leave the strange calling convention of
realloc_string_sub2(), where the caller it
not allowed to use the passed pointer when
NULL is returned...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/20ba81c29f97a9a819157b3fb671a222f6ebef46">20ba81c2</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: let mask_unsafe_character() check all control characters
There's no reason to mask only \r and \n.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/62d75721bcf2b0f8b3681ed60eaffe7a4c740c3e">62d75721</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: add more unsafe characters to STRING_SUB_UNSAFE_CHARACTERS
|&<> are unsafe characters for shell processing.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/20fcc1380b1693b8ce1677dd224a8d556223d213">20fcc138</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: let log_escape() make use of iscntrl()
using iscntrl() also handles 0x7F (DEL).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/6f9febc25552091a98b8c0bb9e94b206b1692fe0">6f9febc2</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: add talloc_string_sub_{mixed_quoting,unsafe}() helpers
This is the basic helper function for the security problems.
talloc_string_sub_mixed_quoting() checks for strange quoting
in smb.conf options.
And talloc_string_sub_unsafe() tries to autodetect how the unsafe
(client controlled value) and masked and single quote it,
as a fallback for strange quoting a fixed fallback string
is used and the caller should warn the admin and give
hints how to fix the configuration.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Pair-Programmed-With: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/9e7b5f0a5687b993fd5a6303c0414a80a206b531">9e7b5f0a</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480/CVE-2026-4408: lib/util: add test_string_sub unittests
This demonstrates the logic of talloc_string_sub_{mixed_quoting,unsafe}()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/2531aac7a30e0d87cbca9b5052fa35adaff7323f">2531aac7</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480: s3:printing: mask and/or single quote jobname passed as %J to "print command"
Fix an unauthenticated remote code execution vulnerability with
printing set to anything *but* cups and iprint, for example "lprng",
so that "print command" is executed upon job submission. If the
client-controlled job name is handed to the "print command" via %J,
rpcd_spoolssd passes this to the shell without escaping critical
characters.
Using single quotes (directly) around %J, '%J' would avoid the
problem, we now try to autodetect if we can use '%J' implicitly
or we fallback to a fixed "__CVE-2026-4480_FallbackJobname__"
string instead of the client provided jobname.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/3d2384d78f80cc7ebb04ce160df9d382538a41c8">3d2384d7</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480: s3:testparm: warn about 'print command' %J usage
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/c6729f4b0284c5906fb5747a01ba79e0a83c6706">c6729f4b</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4480: docs-xml/smbdotconf: clarify '%J' in 'print command'
Admins should use '%J'.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16033
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/14b16002a126f0384a72f6ddf8be9a1dce68efe5">14b16002</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: lib/util: introduce strstr_for_invalid_account_characters()
This splits out the logic from samaccountname_bad_chars_check()
in source4/dsdb/samdb/ldb_modules/samldb.c, this will be used
in other places soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/d1c6fc6e991d0a6080eba00cf5e2b6782578306d">d1c6fc6e</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: s3:samr-server: only allow _samr_ValidatePassword as DC
This is only supported with 'rpc start on demand helpers = no',
as it needs ncacn_ip_tcp, but we better also restrict it to DCs.
Maybe only FreeIPA needs it as NT4 didn't support ncacn_ip_tcp.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/9a77a1c678c6f3d56e957fd57b276c68c9bdaf7c">9a77a1c6</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: s3:samr-server: deny, mask and/or single quote username to 'check password script'
We pass this on to the check password script, prevent remote command
execution.
We now try to autodetect if we could implicitly use '%u' for the
replacement and fallback to a fixed fallback username.
Admins should make use of SAMBA_CPS_ACCOUNT_NAME
instead of passing '%u' to 'check password script'
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Pair-Programmed-With: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/94133ecf9ccf6bfcc449f443e2d71d62450c05b1">94133ecf</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: s3:samr-server: make check_password_complexity_internal() non-static, for easier testing
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/57e21c3478734559cc9af04dae6ce67423c17563">57e21c34</a></strong>
<div>
<span> by Douglas Bagnall </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: s3:torture: tests for password complexity scripts
This tries to demonstrate the new logic for %u in
'check password script'.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/132a5634d44579f71fd2bc9fcd69615cf3239bff">132a5634</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: s3:testparm: warn about 'check password script' %u usage
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/902436a3438de6d8f77cf9b118493921e3d088b5">902436a3</a></strong>
<div>
<span> by Stefan Metzmacher </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>CVE-2026-4408: docs-xml/smbdotconf: clarify '%u' in 'check password script'
Admins should use SAMBA_CPS_ACCOUNT_NAME.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=16034
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/08a164ca98b7aa4a55763d8dc8232abb7db74b02">08a164ca</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-05-15T14:35:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>WHATSNEW: Add release notes for Samba 4.23.8.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/11bc23b9182aca30456c5785f1e63d405899434d">11bc23b9</a></strong>
<div>
<span> by Björn Jacke </span> <i> at 2026-05-15T14:38:40+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>VERSION: Disable GIT_SNAPSHOT for the 4.23.8 release.
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/a360c6aa754c7e762973a0c8f6dd9abec23804f0">a360c6aa</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-05-26T16:01:49+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>New upstream version 4.23.8+dfsg</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/51fda616c2f60b02a89d54cfcdc9fff8d4552798">51fda616</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-05-26T16:02:05+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Update upstream source from tag 'upstream/4.23.8+dfsg'
Update to upstream version '4.23.8+dfsg'
with Debian dir d2e993488972b8078514dccd3e5f5cd9054a55ea</pre>
</li>
<li>
<strong style="font-weight: 600;"><a href="https://salsa.debian.org/samba-team/samba/-/commit/4487a3865f3af4c310833b3ef7838530e3dcf920">4487a386</a></strong>
<div>
<span> by Michael Tokarev </span> <i> at 2026-05-26T16:04:09+03:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #3a383f; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>update changelog; upload version 4.23.8+dfsg-1 to unstable
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
145 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#b33892fbddeffc3368077b4904ad0b3d562a7312">
VERSION
</a>
</li>
<li class="file-stats">
<a href="#3277e12b5a9f9ff632d229e2629d34ad21dd93fc">
WHATSNEW.txt
</a>
</li>
<li class="file-stats">
<a href="#717e4435bfe6c4ce86a7ac15a5461119235be37b">
buildtools/wafsamba/samba_autoconf.py
</a>
</li>
<li class="file-stats">
<a href="#d5ce5488dd16174bafa83601235549a07d6aee8b">
buildtools/wafsamba/samba_cross.py
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#d6eb3f00377264d673e5819f40755b20b89ce248">
docs-xml/smbdotconf/printing/printcommand.xml
</a>
</li>
<li class="file-stats">
<a href="#dc8753a91cebb6ff703c884dd7a66ba13f0c8c51">
docs-xml/smbdotconf/security/checkpasswordscript.xml
</a>
</li>
<li class="file-stats">
<a href="#3c9526842015b4142e3592e0f326162e38af3b25">
lib/util/samba_util.h
</a>
</li>
<li class="file-stats">
<a href="#6199c8b960f492bc1c2e99c0a8f7a422cb7d5756">
lib/util/substitute.c
</a>
</li>
<li class="file-stats">
<a href="#eef36799fcb65e2f2379d82b519dca6e2e151ccd">
lib/util/substitute.h
</a>
</li>
<li class="file-stats">
<a href="#91aa5498ae35dd10f4ad7e42c5778d84a1d839b3">
<span class="new-file">
+
lib/util/tests/test_string_sub.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#920f977b858bb58715332f2592336aeff6b91622">
lib/util/util_str.c
</a>
</li>
<li class="file-stats">
<a href="#d8a820cfbb4c9227d9ce921a00e8e962d1bdc9b2">
lib/util/util_str_escape.c
</a>
</li>
<li class="file-stats">
<a href="#400cdebf703164fa356294af7e4ba155a39ece05">
lib/util/wscript_build
</a>
</li>
<li class="file-stats">
<a href="#5f61f6e699617df0af98b5c0d7393f484faf9b38">
nsswitch/pam_winbind.c
</a>
</li>
<li class="file-stats">
<a href="#630252301d9dbf59616c9af85170f226068e5efb">
python/samba/gp/gp_cert_auto_enroll_ext.py
</a>
</li>
<li class="file-stats">
<a href="#abcbd61b068e27b5501f9dc010f43688de4802a3">
python/samba/tests/gpo.py
</a>
</li>
<li class="file-stats">
<a href="#45a895f722594b89411e669fdcca2bc82f274cdd">
python/samba/tests/smb3unix.py
</a>
</li>
<li class="file-stats">
<a href="#981b2120f786cca0922eb45175f62e3b0c280a5a">
script/autobuild.py
</a>
</li>
<li class="file-stats">
<a href="#f2f5f888a14f7610acd7670c4b77993c1c4589dd">
<span class="new-file">
+
selftest/knownfail.d/gpo-auto-enrol
</span>
</a>
</li>
<li class="file-stats">
<a href="#527e1033d396107d2be275d0ed231501759e6241">
selftest/target/Samba3.pm
</a>
</li>
<li class="file-stats">
<a href="#67802ecd7f5d56293dc57deab3dc856420d0e358">
selftest/tests.py
</a>
</li>
<li class="file-stats">
<a href="#4f41c4ad854211d9ee141a6767561a52384481db">
source3/include/libsmb_internal.h
</a>
</li>
<li class="file-stats">
<a href="#acf67aae74e599985765eef0762957e859c8a4b7">
source3/include/libsmbclient.h
</a>
</li>
<li class="file-stats">
<a href="#7d44b567b6ffc9b1a99474e2c631ec536fc2ed41">
source3/lib/substitute.c
</a>
</li>
<li class="file-stats">
<a href="#5b87877bfbc8ef79d8f9f539a43c99930dfdabee">
source3/lib/substitute_generic.c
</a>
</li>
<li class="file-stats">
<a href="#32cc7fb9e78ba4b78431e9f3e7b1883296aede74">
source3/librpc/crypto/gse_krb5.c
</a>
</li>
<li class="file-stats">
<a href="#5bc5569f13e2313021475564a50c74bd2fbaa7de">
source3/libsmb/libsmb_compat.c
</a>
</li>
<li class="file-stats">
<a href="#fdafef092845d763ec1256401c0e7c5a20a4196d">
source3/libsmb/libsmb_context.c
</a>
</li>
<li class="file-stats">
<a href="#c3336e9dcf44c1056b6fda025c6fc01dbe8eb9a4">
source3/libsmb/libsmb_server.c
</a>
</li>
<li class="file-stats">
<a href="#6994afd9e7ee92e9a5298d4c3acb6acee6afcb3e">
source3/modules/util_reparse.c
</a>
</li>
<li class="file-stats">
<a href="#58968b24119b9fa720393c3f78f2749b78481f3b">
source3/modules/vfs_glusterfs.c
</a>
</li>
<li class="file-stats">
<a href="#c5decdba3cd055733839b1f4d6ae2f82d0998fa6">
source3/modules/vfs_snapper.c
</a>
</li>
<li class="file-stats">
<a href="#3abc80b20f6bc7c193e2deefc57181dcd57833d0">
source3/modules/vfs_worm.c
</a>
</li>
<li class="file-stats">
<a href="#46bd22e7792af07411139a298173a3af3d51a1d1">
source3/printing/print_generic.c
</a>
</li>
<li class="file-stats">
<a href="#e6da3a8454b47cb5120539acf3170dee93a899a1">
source3/rpc_server/rpcd_spoolss.c
</a>
</li>
<li class="file-stats">
<a href="#dbb32561321d0fe7feb4d0772fd31c2e24a48fbd">
source3/rpc_server/samr/srv_samr_chgpasswd.c
</a>
</li>
<li class="file-stats">
<a href="#f8e52f840dd40f4361877f78e5ff9feb2f4a79fa">
source3/rpc_server/samr/srv_samr_nt.c
</a>
</li>
<li class="file-stats">
<a href="#db9f621a27f097f29dec7939695b727c0c326b4f">
source3/rpc_server/samr/srv_samr_util.h
</a>
</li>
<li class="file-stats">
<a href="#2a3b0edc2bd248b0d9fccd48756f59b6856b4dbb">
source3/script/tests/test_worm.sh
</a>
</li>
<li class="file-stats">
<a href="#1a845d6e5a7663f91418c9eeb984924fda3eea88">
<span class="new-file">
+
source3/torture/test_rpc_samr.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#87e9625d824d89ccc33e072816f646ef7c0fbbd9">
source3/torture/wscript_build
</a>
</li>
<li class="file-stats">
<a href="#20d12b0602e308cb04b6c031285ec35afd51deba">
source3/utils/testparm.c
</a>
</li>
<li class="file-stats">
<a href="#be5832040fb43a49bd9e18fa6b8a322b1f341f66">
source4/nbt_server/wins/winsserver.c
</a>
</li>
<li class="file-stats">
<a href="#6e579c36b1d921af6550d6dd8e05d0a4875efafa">
source4/selftest/tests.py
</a>
</li>
<li class="file-stats">
<a href="#5cf0d33922dc60af82a201ea5b40aa469ba69ec2">
source4/torture/libsmbclient/libsmbclient.c
</a>
</li>
<li class="file-stats">
<a href="#3663699e650b3db4472212e4af8c5ce213703b12">
third_party/ngtcp2/crypto/CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#ee54eae3086c09225e374268cd5f8ae5075c64bd">
third_party/ngtcp2/crypto/Makefile.am
</a>
</li>
<li class="file-stats">
<a href="#fc9f3d5d1fd589c7cd51f378a78f56687ad0af9f">
third_party/ngtcp2/crypto/boringssl/boringssl.c
</a>
</li>
<li class="file-stats">
<a href="#539bd562043d88098609c948c95df81fb51d7080">
third_party/ngtcp2/crypto/boringssl/libngtcp2_crypto_boringssl.pc.in
</a>
</li>
<li class="file-stats">
<a href="#757068b6181fb8a14788f19d848911d204bfa124">
third_party/ngtcp2/crypto/gnutls/gnutls.c
</a>
</li>
<li class="file-stats">
<a href="#1a9f18207537df4b457fc0ab984e53e518e6a8df">
third_party/ngtcp2/crypto/gnutls/libngtcp2_crypto_gnutls.pc.in
</a>
</li>
<li class="file-stats">
<a href="#ea2c54d86c6c97098e5e3b5fa8c725a8acb191ba">
third_party/ngtcp2/crypto/includes/CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#651f9b96f54917f694ae14f001c6f16ca83698b5">
third_party/ngtcp2/crypto/includes/Makefile.am
</a>
</li>
<li class="file-stats">
<a href="#482a5cc58d2cac6bb6cc8eab4159b67a7d644694">
third_party/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h
</a>
</li>
<li class="file-stats">
<a href="#a6642da79d162169339dfb03c8c5d1964e5b9d37">
third_party/ngtcp2/crypto/ossl/CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#33506bc24716418901ee7ef36adb927de9261f4c">
third_party/ngtcp2/crypto/ossl/libngtcp2_crypto_ossl.pc.in
</a>
</li>
<li class="file-stats">
<a href="#3540cfc895cbbb1606288e202eebc8e1a14d4da2">
third_party/ngtcp2/crypto/ossl/ossl.c
</a>
</li>
<li class="file-stats">
<a href="#e20b4515801deb981c3026abb42502948ef07f81">
third_party/ngtcp2/crypto/picotls/libngtcp2_crypto_picotls.pc.in
</a>
</li>
<li class="file-stats">
<a href="#c9d4fcef1efab416b1a32a118a3f0c3c24dffe96">
third_party/ngtcp2/crypto/picotls/picotls.c
</a>
</li>
<li class="file-stats">
<a href="#aaba6b15885fec029dfdd4bc014929ee76fadecd">
third_party/ngtcp2/crypto/quictls/.gitignore
</a>
</li>
<li class="file-stats">
<a href="#12b28749c0a6fc1772d46782f5b56f57bbdb76b8">
third_party/ngtcp2/crypto/quictls/CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#0ee399c8589d413fd4ae475f01428aba6a5fb792">
third_party/ngtcp2/crypto/quictls/Makefile.am
</a>
</li>
<li class="file-stats">
<a href="#7b95a080e4730c09904c0b90819038858c5ff70a">
<span class="new-file">
+
third_party/ngtcp2/crypto/quictls/libngtcp2_crypto_libressl.pc.in
</span>
</a>
</li>
<li class="file-stats">
<a href="#95463b8c08e5dd6998d009561425c1be90f6a125">
third_party/ngtcp2/crypto/quictls/libngtcp2_crypto_quictls.pc.in
</a>
</li>
<li class="file-stats">
<a href="#49f48e37f955dc620ed1658d9488535a79d1b086">
third_party/ngtcp2/crypto/quictls/quictls.c
</a>
</li>
<li class="file-stats">
<a href="#0ac665348dc38fb6a3c68a1c1abd67e773f3a8b3">
third_party/ngtcp2/crypto/shared.c
</a>
</li>
<li class="file-stats">
<a href="#26b8fe5495853495536607940f2e4d89abef6bfd">
third_party/ngtcp2/crypto/shared.h
</a>
</li>
<li class="file-stats">
<a href="#2a59f8fda95b42c533e2ffdaf947b32bbe982145">
third_party/ngtcp2/crypto/wolfssl/libngtcp2_crypto_wolfssl.pc.in
</a>
</li>
<li class="file-stats">
<a href="#d9c27376bed89adc7438219568d2585e9d03f669">
third_party/ngtcp2/crypto/wolfssl/wolfssl.c
</a>
</li>
<li class="file-stats">
<a href="#f18fd243b180470a7d011483aebd424efa81d350">
third_party/ngtcp2/lib/CMakeLists.txt
</a>
</li>
<li class="file-stats">
<a href="#af3eba3b58338b322935d2ce1213c5790968fd8b">
third_party/ngtcp2/lib/Makefile.am
</a>
</li>
<li class="file-stats">
<a href="#4afdddd8848169a39db6d6e591c88fe218c98b83">
third_party/ngtcp2/lib/config.cmake.in
</a>
</li>
<li class="file-stats">
<a href="#bbce355898686f206de7ec9b0e85f0f5208f191e">
third_party/ngtcp2/lib/includes/ngtcp2/ngtcp2.h
</a>
</li>
<li class="file-stats">
<a href="#b1be6b2083fdcf409c62d9eeb7bec92a42f2c499">
third_party/ngtcp2/lib/ngtcp2_acktr.c
</a>
</li>
<li class="file-stats">
<a href="#a8354dc95b0c8213f094763771508af7d096a743">
third_party/ngtcp2/lib/ngtcp2_acktr.h
</a>
</li>
<li class="file-stats">
<a href="#29625654f3f8e350e92e84485c583d9ce71fd50c">
third_party/ngtcp2/lib/ngtcp2_addr.c
</a>
</li>
<li class="file-stats">
<a href="#3cdccee38920ab9ac55c91cae03dd1b157eefd5c">
third_party/ngtcp2/lib/ngtcp2_addr.h
</a>
</li>
<li class="file-stats">
<a href="#26071adee4abf522fa49e68dd5a5c8bf336e3557">
third_party/ngtcp2/lib/ngtcp2_balloc.c
</a>
</li>
<li class="file-stats">
<a href="#519f3da01aaf4b3a3894d8564635b8484776644a">
third_party/ngtcp2/lib/ngtcp2_bbr.c
</a>
</li>
<li class="file-stats">
<a href="#0d5941019693898c4cf52dd96b89a17d06560d61">
third_party/ngtcp2/lib/ngtcp2_bbr.h
</a>
</li>
<li class="file-stats">
<a href="#fd05ece3bdc0c01538357a692e1066c5ea8f7bfc">
third_party/ngtcp2/lib/ngtcp2_buf.c
</a>
</li>
<li class="file-stats">
<a href="#07b9a542df80f70798a530f0efaf5628aa39ae9a">
third_party/ngtcp2/lib/ngtcp2_buf.h
</a>
</li>
<li class="file-stats">
<a href="#3011294d8e0495bf9368020a475cd67889f01e57">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_callbacks.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#19bc279652390cf933ffdd9f84bce9ee9e6d278e">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_callbacks.h
</span>
</a>
</li>
<li class="file-stats">
<a href="#3d2f3cda63c4f629dd28b38d89ca44e42101618a">
third_party/ngtcp2/lib/ngtcp2_cc.c
</a>
</li>
<li class="file-stats">
<a href="#5c5f9610b93e35d59b98e74535f5597291a2c09b">
third_party/ngtcp2/lib/ngtcp2_cc.h
</a>
</li>
<li class="file-stats">
<a href="#25c715d8cdbb10373189594cde986bd2f327d09e">
third_party/ngtcp2/lib/ngtcp2_cid.c
</a>
</li>
<li class="file-stats">
<a href="#1546c479ca35066848a89c4dfc02d25b59b1fb20">
third_party/ngtcp2/lib/ngtcp2_cid.h
</a>
</li>
<li class="file-stats">
<a href="#75380d8aa7aa0eff0bf0d9baadd4cbd14119798f">
third_party/ngtcp2/lib/ngtcp2_conn.c
</a>
</li>
<li class="file-stats">
<a href="#7ae9a944655820037d8d0b5b2e4f8579ffa0d615">
third_party/ngtcp2/lib/ngtcp2_conn.h
</a>
</li>
<li class="file-stats">
<a href="#f4d29b2ec72a27513a1b205edb66b86fa4b4cb52">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_conn_info.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#cff2c8d070e299ee6ed9648e9ee47d4afb3f7587">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_conn_info.h
</span>
</a>
</li>
<li class="file-stats">
<a href="#a53419a34cd81a31aef8fb72b79f4f075a1ed5d9">
third_party/ngtcp2/lib/ngtcp2_conn_stat.h
</a>
</li>
<li class="file-stats">
<a href="#e2db8d294e68b218e48e0dbc341331e22f82f9e0">
third_party/ngtcp2/lib/ngtcp2_conv.c
</a>
</li>
<li class="file-stats">
<a href="#90dd345d2bddb26e793dfc86a76ca4da2866df91">
third_party/ngtcp2/lib/ngtcp2_crypto.c
</a>
</li>
<li class="file-stats">
<a href="#1a7c09dc560a0b4148d122743798c23f54c0e73c">
third_party/ngtcp2/lib/ngtcp2_crypto.h
</a>
</li>
<li class="file-stats">
<a href="#06521a04b1cb6341ad81c9c475e4c1417e66915d">
third_party/ngtcp2/lib/ngtcp2_dcidtr.c
</a>
</li>
<li class="file-stats">
<a href="#65d7328eea5e3c9c0b3cf37ffb939804d095cbcc">
third_party/ngtcp2/lib/ngtcp2_dcidtr.h
</a>
</li>
<li class="file-stats">
<a href="#df6f797ea8cda4964cae1964740d3d1b41c0c334">
third_party/ngtcp2/lib/ngtcp2_frame_chain.c
</a>
</li>
<li class="file-stats">
<a href="#f9d5157956fa631ba7b49eabc6daf41bb83a72b0">
third_party/ngtcp2/lib/ngtcp2_frame_chain.h
</a>
</li>
<li class="file-stats">
<a href="#39f57a9260391c75c6ed9d96654c50109ebe5810">
third_party/ngtcp2/lib/ngtcp2_gaptr.c
</a>
</li>
<li class="file-stats">
<a href="#dee72a699f36edda8acc08f192b88bf00405f208">
third_party/ngtcp2/lib/ngtcp2_ksl.c
</a>
</li>
<li class="file-stats">
<a href="#4c6df269af8b388cf09c40806ba9b4ba026754e1">
third_party/ngtcp2/lib/ngtcp2_ksl.h
</a>
</li>
<li class="file-stats">
<a href="#ea5cfe854a34fa5b509c26e18a00d7e7b4538d43">
third_party/ngtcp2/lib/ngtcp2_log.c
</a>
</li>
<li class="file-stats">
<a href="#3d53f29dce46cc0168978708b46e73e53f26dc9c">
third_party/ngtcp2/lib/ngtcp2_log.h
</a>
</li>
<li class="file-stats">
<a href="#bad4c483278569cd70e1780c584b5af7ba40f1ea">
third_party/ngtcp2/lib/ngtcp2_macro.h
</a>
</li>
<li class="file-stats">
<a href="#4874a35b3330c569713533d5521580859c14ca5a">
third_party/ngtcp2/lib/ngtcp2_map.c
</a>
</li>
<li class="file-stats">
<a href="#20872325a591117c62186fdde92fc1386453947b">
third_party/ngtcp2/lib/ngtcp2_map.h
</a>
</li>
<li class="file-stats">
<a href="#a9d8f0c78bd14102a000f8087f022e51f2da92c7">
third_party/ngtcp2/lib/ngtcp2_net.h
</a>
</li>
<li class="file-stats">
<a href="#50d943f8121be8851ca67f058efd9ff9360ec901">
third_party/ngtcp2/lib/ngtcp2_objalloc.h
</a>
</li>
<li class="file-stats">
<a href="#f70baf608b76643ded00497d797d4c7b593b7866">
third_party/ngtcp2/lib/ngtcp2_path.c
</a>
</li>
<li class="file-stats">
<a href="#f725a44df779e7b8cb672e010b25a2db5e578359">
third_party/ngtcp2/lib/ngtcp2_path.h
</a>
</li>
<li class="file-stats">
<a href="#591ef45b5f594738e15056cf16a3357eb811129a">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_pcg.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#dd368f70717067bd28c31416358ba94640ada73e">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_pcg.h
</span>
</a>
</li>
<li class="file-stats">
<a href="#ed11acfa46a69b085a3dc13975b0b690c871746e">
third_party/ngtcp2/lib/ngtcp2_pkt.c
</a>
</li>
<li class="file-stats">
<a href="#6ee75082e5774cf488c06a512abb1f543e7050ff">
third_party/ngtcp2/lib/ngtcp2_pkt.h
</a>
</li>
<li class="file-stats">
<a href="#67d741c325c47ecb9b85a28ce55be51fe99c9009">
third_party/ngtcp2/lib/ngtcp2_ppe.c
</a>
</li>
<li class="file-stats">
<a href="#158fc9a18bddb3d678a4235b5e4b8c6a70657f77">
third_party/ngtcp2/lib/ngtcp2_pv.c
</a>
</li>
<li class="file-stats">
<a href="#b2b96e674783fd9c61fc343480aa3b213e72946b">
third_party/ngtcp2/lib/ngtcp2_pv.h
</a>
</li>
<li class="file-stats">
<a href="#c51fedd9273153cbc5c8064d988e8c5618708156">
third_party/ngtcp2/lib/ngtcp2_qlog.c
</a>
</li>
<li class="file-stats">
<a href="#9a20aca439576ca9447f0413fc909c422efd172f">
third_party/ngtcp2/lib/ngtcp2_qlog.h
</a>
</li>
<li class="file-stats">
<a href="#f32b7752b3af0a06a45cb965a28f62e302592f48">
third_party/ngtcp2/lib/ngtcp2_range.c
</a>
</li>
<li class="file-stats">
<a href="#9be42d7f884cb614423138cd701c4ffc10d39ea9">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_ratelim.c
</span>
</a>
</li>
<li class="file-stats">
<a href="#dc748be82291322703e49b2d7ecd80c5bfa3b264">
<span class="new-file">
+
third_party/ngtcp2/lib/ngtcp2_ratelim.h
</span>
</a>
</li>
<li class="file-stats">
<a href="#635a84d12270574b232715b02e2ea8613f7354bf">
third_party/ngtcp2/lib/ngtcp2_ringbuf.c
</a>
</li>
<li class="file-stats">
<a href="#044e0dba8082e0746e4d8e7f13fbf5231a3b88c3">
third_party/ngtcp2/lib/ngtcp2_ringbuf.h
</a>
</li>
<li class="file-stats">
<a href="#b1ea3fe8b76370485e2ab7510dd509091b5b27d5">
third_party/ngtcp2/lib/ngtcp2_rob.c
</a>
</li>
<li class="file-stats">
<a href="#7a393af4e37179d20406cbf735930c5509425c3d">
third_party/ngtcp2/lib/ngtcp2_rob.h
</a>
</li>
<li class="file-stats">
<a href="#ddbab6c9db81a063f0b00f5002de3f55422d9480">
third_party/ngtcp2/lib/ngtcp2_rst.c
</a>
</li>
<li class="file-stats">
<a href="#43e5dc6090b46c765871b048db2cf2e3fcc9a045">
third_party/ngtcp2/lib/ngtcp2_rst.h
</a>
</li>
<li class="file-stats">
<a href="#4d42b404f9999c1af247b926dafbf9961896735a">
third_party/ngtcp2/lib/ngtcp2_rtb.c
</a>
</li>
<li class="file-stats">
<a href="#bc0ccc25082d5cfe29d870555a2bd8628b8a9623">
third_party/ngtcp2/lib/ngtcp2_rtb.h
</a>
</li>
<li class="file-stats">
<a href="#e8ee66d3170f6b0f251aa742dc8b2a565eddf5d8">
third_party/ngtcp2/lib/ngtcp2_settings.c
</a>
</li>
<li class="file-stats">
<a href="#5b9ab859c45bcc4d227b885f39f051243ca60337">
third_party/ngtcp2/lib/ngtcp2_settings.h
</a>
</li>
<li class="file-stats">
<a href="#19ee04655b46bab695130e14970a154d16dbf3a3">
third_party/ngtcp2/lib/ngtcp2_str.c
</a>
</li>
<li class="file-stats">
<a href="#87377328df95b64fc38c627301a2fb5392f1b329">
third_party/ngtcp2/lib/ngtcp2_str.h
</a>
</li>
<li class="file-stats">
<a href="#9fd1e456661b269a5af8b25ef8e9ed2f60ce3a77">
third_party/ngtcp2/lib/ngtcp2_strm.c
</a>
</li>
<li class="file-stats">
<a href="#4a942a2e8c9c5b524c3b6b3c19826946d80b28ef">
third_party/ngtcp2/lib/ngtcp2_strm.h
</a>
</li>
<li class="file-stats">
<a href="#35e66d56e928db49a2b156d755267f0141fea875">
third_party/ngtcp2/lib/ngtcp2_transport_params.c
</a>
</li>
<li class="file-stats">
<a href="#d531bc31581eb730a551dcb9f7e8608c017df0f0">
third_party/ngtcp2/lib/ngtcp2_transport_params.h
</a>
</li>
<li class="file-stats">
<a href="#d36aed51d024de304d43339aed4c95c4937b5184">
third_party/ngtcp2/lib/ngtcp2_vec.c
</a>
</li>
<li class="file-stats">
<a href="#8e51207cbe0b0257e70df47354d05c99762d823c">
third_party/ngtcp2/lib/ngtcp2_vec.h
</a>
</li>
<li class="file-stats">
<a href="#828eeb080e268165718f00402976394d0a934875">
third_party/ngtcp2/lib/ngtcp2_window_filter.c
</a>
</li>
<li class="file-stats">
<a href="#90ea2008beeaa656bd24f0348f6b990c94c6daa1">
third_party/ngtcp2/wscript
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: .875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
<a href="https://salsa.debian.org/samba-team/samba/-/compare/d45a8b67d7929d7208937570e65f34e38e40f0bb...4487a3865f3af4c310833b3ef7838530e3dcf920">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://salsa.debian.org/samba-team/samba/-/compare/d45a8b67d7929d7208937570e65f34e38e40f0bb...4487a3865f3af4c310833b3ef7838530e3dcf920 at 1779800718
</span>
</p>
</div>
</body>
</html>