[Git][security-tracker-team/security-tracker][master] 16 commits: lts: triage libsoup3 in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Sat Oct 3 23:21:49 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8fe28a48 by Utkarsh Gupta at 2026-10-04T03:39:33+05:30
lts: triage libsoup3 in bookworm
- - - - -
df78c59d by Utkarsh Gupta at 2026-10-04T03:39:35+05:30
lts: ocsinventory-server postponed in bookworm
- - - - -
7bcb3dff by Utkarsh Gupta at 2026-10-04T03:39:37+05:30
lts: rust-coreutils postponed in bookworm
- - - - -
1434f0d6 by Utkarsh Gupta at 2026-10-04T03:39:38+05:30
lts: rust-rustls postponed in bookworm
- - - - -
45fdd2e8 by Utkarsh Gupta at 2026-10-04T03:39:40+05:30
lts: lxd end-of-life in bookworm
- - - - -
769a4717 by Utkarsh Gupta at 2026-10-04T03:39:42+05:30
lts: triage golang-github-rabbitmq-amqp091-go in bookworm
- - - - -
e1bf6e16 by Utkarsh Gupta at 2026-10-04T03:39:43+05:30
lts: golang-github-klauspost-compress not-affected in bookworm
- - - - -
632c1550 by Utkarsh Gupta at 2026-10-04T03:39:45+05:30
lts: node-webfont not-affected in bookworm
- - - - -
412eaa30 by Utkarsh Gupta at 2026-10-04T03:39:45+05:30
dla-needed: add php-mongodb
- - - - -
ebfef5aa by Utkarsh Gupta at 2026-10-04T03:39:47+05:30
lts: triage node-nodemailer in bookworm
- - - - -
e1073482 by Utkarsh Gupta at 2026-10-04T03:39:49+05:30
lts: golang-opentelemetry-otel not-affected in bookworm
- - - - -
864fd8e3 by Utkarsh Gupta at 2026-10-04T03:39:50+05:30
merge duplicate RUSTSEC placeholder into rust-zip entry
- - - - -
1628d95e by Utkarsh Gupta at 2026-10-04T03:39:52+05:30
lts: simdjson not-affected in bookworm
- - - - -
d7e1cd55 by Utkarsh Gupta at 2026-10-04T03:39:54+05:30
lts: triage node-axios in bookworm
- - - - -
2b2c2749 by Utkarsh Gupta at 2026-10-04T03:39:55+05:30
lts: nvidia-open-gpu-kernel-modules ignored in bookworm
- - - - -
1c8d620c by Utkarsh Gupta at 2026-10-04T03:39:55+05:30
dla-needed: add nvidia-graphics-drivers
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -2843,6 +2843,7 @@ CVE-2026-47604 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2864,6 +2865,7 @@ CVE-2026-47603 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2885,6 +2887,7 @@ CVE-2026-47602 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2906,6 +2909,7 @@ CVE-2026-47601 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2927,6 +2931,7 @@ CVE-2026-47600 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2948,6 +2953,7 @@ CVE-2026-47599 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2969,6 +2975,7 @@ CVE-2026-47598 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -2990,6 +2997,7 @@ CVE-2026-47597 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -3011,6 +3019,7 @@ CVE-2026-47596 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -3032,6 +3041,7 @@ CVE-2026-47595 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1149643)
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
+ [bookworm] - nvidia-open-gpu-kernel-modules <ignored> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
[bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
@@ -4617,6 +4627,7 @@ CVE-2026-103432 (apcupsd through 3.14.14 has an sscanf stack-based buffer overfl
CVE-2026-103399 (A flaw was found in SoupServer (libsoup). When an HTTP/1.x client send ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <ignored> (Limited support, server unsupported)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543949
@@ -5599,6 +5610,7 @@ CVE-2026-65102 (NVIDIA DeepStream contains a vulnerability where an attacker co
CVE-2026-63209 (compress provides various compression algorithms. Prior to version 1.1 ...)
- golang-github-klauspost-compress 1.19.0+ds1-1
[trixie] - golang-github-klauspost-compress <no-dsa> (Minor issue)
+ [bookworm] - golang-github-klauspost-compress <not-affected> (Vulnerable code introduced in 1.16.0)
NOTE: https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
NOTE: Fixed by: https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536 (v1.19.0)
CVE-2026-4523 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
@@ -5802,6 +5814,7 @@ CVE-2026-102566 (CTranslate2 before 4.8.1 contains a heap-based buffer overflow
CVE-2026-102560 (A flaw was found in libsoup. When the permessage-deflate WebSocket ext ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543296
@@ -5810,6 +5823,7 @@ CVE-2026-102560 (A flaw was found in libsoup. When the permessage-deflate WebSoc
CVE-2026-102559 (A flaw was found in libsoup. When constructing a masked WebSocket clie ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543285
@@ -5818,6 +5832,7 @@ CVE-2026-102559 (A flaw was found in libsoup. When constructing a masked WebSock
CVE-2026-102558 (A flaw was found in libsoup. When max-incoming-payload-size is unlimit ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543274
@@ -5826,6 +5841,7 @@ CVE-2026-102558 (A flaw was found in libsoup. When max-incoming-payload-size is
CVE-2026-102557 (A flaw was found in libsoup. When reassembling fragmented WebSocket me ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543231
@@ -5834,6 +5850,7 @@ CVE-2026-102557 (A flaw was found in libsoup. When reassembling fragmented WebSo
CVE-2026-102556 (A flaw was found in libsoup. When handling an incoming WebSocket Pong ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543229
@@ -5842,6 +5859,7 @@ CVE-2026-102556 (A flaw was found in libsoup. When handling an incoming WebSocke
CVE-2026-102555 (A flaw was found in libsoup. The soup_uri_decode_data_uri() function i ...)
- libsoup3 3.8.0-1
[trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <postponed> (Minor issue)
- libsoup2.4 <removed>
[trixie] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543224
@@ -7016,6 +7034,7 @@ CVE-2026-97399 (The strncasecmp function in the GNU C Library 2.24 and later opt
NOTE: https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0024
CVE-2026-97335 (Incorrect authorization in the custom storage volume creation endpoint ...)
- lxd <removed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-p456-92fx-44xh
CVE-2026-96740 (A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-su ...)
NOT-FOR-US: Apache software not packaged in Debian
@@ -7087,9 +7106,11 @@ CVE-2026-87969 (An OS command injection vulnerability in the WatchGuard AP diagn
NOT-FOR-US: WatchGuard
CVE-2026-87799 (Improper link resolution in the migration receive path in Canonical LX ...)
- lxd <removed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-fmc3-3cpq-6whr
CVE-2026-87798 (Improper link resolution in the recursive file pull feature of the LXD ...)
- lxd <removed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-mr8v-hx34-hfvf
CVE-2026-87752 (Improper neutralization of input during web page generation ('cross-si ...)
NOT-FOR-US: Agentis
@@ -7103,9 +7124,11 @@ CVE-2026-86507 (Improper neutralization of input in Apache Roller 6.1.5 allows a
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-86335 (Missing Authorization in imageDownload in Canonical LXD before 5.0.10, ...)
- lxd <removed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-j7p3-5g2v-69j8
CVE-2026-86334 (Path traversal in the CLI client image export and copy functionality i ...)
- lxd <removed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/canonical/lxd/security/advisories/GHSA-g4cm-f533-78hq
CVE-2026-86330 (An OS command injection flaw was found in the set_hostname_internal fu ...)
NOT-FOR-US: NooBaa
@@ -7284,6 +7307,7 @@ CVE-2026-101910 (ip-address is a library for parsing and manipulating IPv4 and I
CVE-2026-101909 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <postponed> (Minor issue)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
@@ -7291,54 +7315,63 @@ CVE-2026-101909 (Axios is a promise-based HTTP client for the browser and Node.j
CVE-2026-101908 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, fetch adapter introduced in 1.7.0)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101907 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, fetch adapter introduced in 1.7.0)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-r4gj-5m52-g5wh
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101906 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, shouldBypassProxy() introduced in 1.15.0)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-mghh-pgcx-3jjj
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101905 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <postponed> (Minor issue)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101904 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <postponed> (Minor issue)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101903 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, data: URL regex introduced in 1.16.1)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-c29m-xwm3-cm6r
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101902 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <postponed> (Minor issue)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101901 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, HTTP/2 support introduced in 1.13.0)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
CVE-2026-101900 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
- node-axios 1.20.0-1
[trixie] - node-axios <no-dsa> (Minor issue)
+ [bookworm] - node-axios <not-affected> (Vulnerable code not present, resolveConfig() getHeaders merge introduced in 1.12.0)
NOTE: https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
NOTE: https://github.com/axios/axios/pull/11141
NOTE: Fixed by: https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a (v1.20.0)
@@ -8145,21 +8178,25 @@ CVE-2026-100703 (Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib C
CVE-2026-100702 (Nodemailer before 10.0.2 fails to properly flatten deeply nested array ...)
- node-nodemailer 10.0.10+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66 (v10.0.2)
CVE-2026-100701 (Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cach ...)
- node-nodemailer 10.0.10+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe (v10.0.2)
CVE-2026-100700 (nodemailer before 10.0.6 contains a denial of service vulnerability in ...)
- node-nodemailer 10.0.10+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102 (v10.0.6)
CVE-2026-100699 (Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 an ...)
- node-nodemailer 10.0.10+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee (v10.0.9)
CVE-2026-100698 (Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' strin ...)
@@ -11352,6 +11389,7 @@ CVE-2026-88359 (libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_a
CVE-2026-88358 (simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in ...)
- simdjson <unfixed> (bug #1149053)
[trixie] - simdjson <no-dsa> (Minor issue)
+ [bookworm] - simdjson <not-affected> (Vulnerable parse_unpadded() API introduced in 5.0.0)
NOTE: https://github.com/simdjson/simdjson/issues/2815
NOTE: https://github.com/simdjson/simdjson/pull/2817
NOTE: Fixed by: https://github.com/simdjson/simdjson/commit/20b28712ffce8320237b75a587d35a2e89140577
@@ -16246,6 +16284,7 @@ CVE-2026-93709 (Dancer2 versions before 2.2.0 for Perl serve a layout as a page
CVE-2026-XXXX [RUSTSEC-2026-0285]
- rust-rustls 0.23.45+ds-1
[trixie] - rust-rustls <no-dsa> (Minor issue)
+ [bookworm] - rust-rustls <postponed> (Limited support, minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0285.html
NOTE: https://github.com/rustls/rustls/security/advisories/GHSA-2mjx-qc3c-rqvc
CVE-2026-XXXX [RUSTSEC-2026-0286]
@@ -17187,6 +17226,7 @@ CVE-2026-93659 (Concrete CMS Community Store before 2.7.8 renders customer-suppl
CVE-2026-93658 (uutils coreutils versions before 0.10.0 apply setuid or setgid mode to ...)
- rust-coreutils 0.10.0-1
[trixie] - rust-coreutils <no-dsa> (Minor issue)
+ [bookworm] - rust-coreutils <postponed> (Limited support, minor issue)
NOTE: https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m
NOTE: https://github.com/uutils/coreutils/pull/13629
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55 (0.10.0)
@@ -21690,17 +21730,20 @@ CVE-2026-92599 (joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and
CVE-2026-92598 (Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encod ...)
- node-nodemailer 10.0.0+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148 (v9.1.0)
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e (v9.1.0)
CVE-2026-92597 (Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments ...)
- node-nodemailer 10.0.0+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <not-affected> (Vulnerable code introduced in 6.9.16)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880 (v9.1.0)
CVE-2026-92596 (Nodemailer before 9.1.0 contains a quadratic time complexity vulnerabi ...)
- node-nodemailer 10.0.0+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434 (v9.1.0)
NOTE: Fixed by: https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e (v9.1.0)
@@ -21709,6 +21752,7 @@ CVE-2026-92596 (Nodemailer before 9.1.0 contains a quadratic time complexity vul
CVE-2026-92595 (Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do no ...)
- node-nodemailer 10.0.0+~8.0.1-1
[trixie] - node-nodemailer <no-dsa> (Minor issue)
+ [bookworm] - node-nodemailer <postponed> (Minor issue)
NOTE: https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8m3c-c648-2xjj
CVE-2026-92594 (Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authori ...)
NOT-FOR-US: Craft CMS or plugin for Craft CMS
@@ -21862,6 +21906,7 @@ CVE-2026-81872 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prio
[experimental] - golang-opentelemetry-otel 1.46.0-1~exp1
- golang-opentelemetry-otel <unfixed> (bug #1149049)
[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
+ [bookworm] - golang-opentelemetry-otel <not-affected> (Vulnerable code introduced in 1.26.0)
NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
NOTE: https://github.com/open-telemetry/opentelemetry-go/issues/6797
NOTE: https://github.com/open-telemetry/opentelemetry-go/pull/8620
@@ -21871,6 +21916,7 @@ CVE-2026-81871 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prio
[experimental] - golang-opentelemetry-otel 1.46.0-1~exp1
- golang-opentelemetry-otel <unfixed> (bug #1149049)
[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
+ [bookworm] - golang-opentelemetry-otel <not-affected> (Vulnerable code introduced in 1.28.0)
NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x
NOTE: Introduced with: https://github.com/open-telemetry/opentelemetry-go/commit/d99c76fa32fbbcf3e1e0cee4c49a7f181b0697bb (v1.28.0)
NOTE: Fixed by: https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c (v1.45.0)
@@ -21878,6 +21924,7 @@ CVE-2026-81870 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. From
[experimental] - golang-opentelemetry-otel 1.46.0-1~exp1
- golang-opentelemetry-otel <unfixed> (bug #1149049)
[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
+ [bookworm] - golang-opentelemetry-otel <not-affected> (Vulnerable code introduced in 1.5.0)
NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg
NOTE: https://github.com/open-telemetry/opentelemetry-go/pull/8438
NOTE: Introduced with: https://github.com/open-telemetry/opentelemetry-go/commit/a1fff3c2588c783d1f3f6fd2315aa2660fc6d330 (v1.5.0)
@@ -21885,6 +21932,7 @@ CVE-2026-81870 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. From
CVE-2026-81869 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. From versi ...)
- golang-opentelemetry-otel 1.43.0-1
[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
+ [bookworm] - golang-opentelemetry-otel <not-affected> (Vulnerable code introduced in 1.10.0)
NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8
NOTE: https://github.com/open-telemetry/opentelemetry-go/issues/5996
NOTE: https://github.com/open-telemetry/opentelemetry-go/pull/5997
@@ -23853,60 +23901,70 @@ CVE-2026-77702 (The Eventin WordPress plugin before 4.1.24 does not prevent the
CVE-2026-77412 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readFi ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3
NOTE: https://github.com/rabbitmq/amqp091-go/pull/344
NOTE: https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf (v1.13.0)
CVE-2026-77411 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLo ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-c5pq-fr2g-9jpf
NOTE: https://github.com/rabbitmq/amqp091-go/pull/347
NOTE: https://github.com/rabbitmq/amqp091-go/commit/143c1ace5fa7344cee135e5c7d22970f0de68282 (v1.13.0)
CVE-2026-77410 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channe ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh
NOTE: https://github.com/rabbitmq/amqp091-go/pull/346
NOTE: https://github.com/rabbitmq/amqp091-go/commit/91b65fa0096a99a580cf51a31b24028ff1c60382 (v1.13.0)
CVE-2026-77409 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channe ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j
NOTE: https://github.com/rabbitmq/amqp091-go/pull/349
NOTE: https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494 (v1.13.0)
CVE-2026-77408 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the wr ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-j497-x9hr-x34x
NOTE: https://github.com/rabbitmq/amqp091-go/pull/354
NOTE: https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0 (v1.13.0)
CVE-2026-77407 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainA ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv
NOTE: https://github.com/rabbitmq/amqp091-go/pull/350
NOTE: https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f (v1.13.0)
CVE-2026-77406 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channe ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33
NOTE: https://github.com/rabbitmq/amqp091-go/pull/351
NOTE: https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b (v1.13.0)
CVE-2026-77405 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsCon ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h
NOTE: https://github.com/rabbitmq/amqp091-go/pull/355
NOTE: https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e (v1.13.0)
CVE-2026-77404 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.St ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <not-affected> (Vulnerable code introduced in 1.10.0)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-465g-fh3v-9jw4
NOTE: https://github.com/rabbitmq/amqp091-go/pull/352
NOTE: https://github.com/rabbitmq/amqp091-go/commit/743d488e46955fe7ffc55506fe2c401d01216783 (v1.13.0)
CVE-2026-77403 (RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connec ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
+ [bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2
NOTE: https://github.com/rabbitmq/amqp091-go/pull/353
NOTE: https://github.com/rabbitmq/amqp091-go/commit/2e0a919b89f337dbf58db2bb34ab206dac354a06 (v1.13.0)
@@ -41714,18 +41772,23 @@ CVE-2026-77999 (Joomla Extension - j2commerce.com - Unauthenticated PayPal callb
NOT-FOR-US: Joomla
CVE-2026-76178 (A stored Cross-Site Scripting (XSS) vulnerability in the notification ...)
- ocsinventory-server <unfixed> (bug #1146890)
+ [bookworm] - ocsinventory-server <postponed> (Limited support, minor issue)
NOTE: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng
CVE-2026-76177 (Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?f ...)
- ocsinventory-server <unfixed> (bug #1146890)
+ [bookworm] - ocsinventory-server <postponed> (Limited support, minor issue)
NOTE: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng
CVE-2026-76176 (SQL injection vulnerability in the endpoint /ocsreports/index.php?func ...)
- ocsinventory-server <unfixed> (bug #1146890)
+ [bookworm] - ocsinventory-server <postponed> (Limited support, minor issue)
NOTE: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng
CVE-2026-76175 (SQL injection vulnerability in the del_check parameter of the /ocsrepo ...)
- ocsinventory-server <unfixed> (bug #1146890)
+ [bookworm] - ocsinventory-server <postponed> (Limited support, minor issue)
NOTE: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng
CVE-2026-76174 (Unrestricted file upload vulnerability in the CSV file upload function ...)
- ocsinventory-server <unfixed> (bug #1146890)
+ [bookworm] - ocsinventory-server <postponed> (Limited support, minor issue)
NOTE: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-ocsreports-ocs-inventory-ng
CVE-2026-75602 (OpenList a file list program that supports multiple storage. Prior to ...)
NOT-FOR-US: OpenList
@@ -67660,10 +67723,6 @@ CVE-2025-71405 (chi versions before v5.2.2 contain an open redirect vulnerabilit
NOTE: https://github.com/go-chi/chi/security/advisories/GHSA-vrw8-fxc6-2r93
CVE-2023-7347
REJECTED
-CVE-2026-XXXX [RUSTSEC-2025-0168]
- - rust-zip 2.5.0-1
- NOTE: https://rustsec.org/advisories/RUSTSEC-2025-0168.html
- NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
CVE-2026-XXXX [RUSTSEC-2025-0167]
- rust-bitmaps <not-affected> (Only affects 3.2.0)
NOTE: https://rustsec.org/advisories/RUSTSEC-2025-0167.html
@@ -68435,6 +68494,7 @@ CVE-2026-73570 (A remote code execution vulnerability exists in Zimbra Collabora
CVE-2026-73569 (fast-xml-parser allows users to process XML from JS object without C/C ...)
- node-webfont <unfixed> (bug #1147730)
[trixie] - node-webfont <no-dsa> (Minor issue)
+ [bookworm] - node-webfont <not-affected> (Vulnerable code not present)
NOTE: https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
NOTE: https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f (v5.10.1)
NOTE: node-webfont provides node-fast-xml-parser
@@ -313791,6 +313851,7 @@ CVE-2025-29788 (The Syliud PayPal Plugin is the Sylius Core Team\u2019s plugin f
NOT-FOR-US: Syliud PayPal Plugin
CVE-2025-29787 (`zip` is a zip library for rust which supports reading and writing of ...)
- rust-zip <not-affected> (Vulnerable code never in Debian released revision)
+ NOTE: https://rustsec.org/advisories/RUSTSEC-2025-0168.html
NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
NOTE: Introduced with: https://github.com/zip-rs/zip2/commit/633a6733e6ebb19de9745d6679935c2b168821d0 (v1.3.)
NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe (v2.3.0)
=====================================
data/dla-needed.txt
=====================================
@@ -496,6 +496,18 @@ ntfs-3g
NOTE: 20260716: Added by Front-Desk (Beuc)
NOTE: 20260716: Follow DSA-6389-1 (9 CVEs) (Beuc/front-desk)
--
+nvidia-graphics-drivers
+ NOTE: 20261003: Added by Front-Desk (utkarsh)
+ NOTE: 20261003: R535 reached EOL upstream in June 2026 and NVIDIA fixes the
+ NOTE: 20261003: 81 open bulletin-5861 CVEs only in R580+ (580.178.04, which
+ NOTE: 20261003: supports every R535 GPU), so this needs a branch jump like
+ NOTE: 20261003: 470->535 in DLA-4752-1. Debian has no R580 packaging yet
+ NOTE: 20261003: (trixie/sid: 550), and bookworm must not outrank trixie:
+ NOTE: 20261003: coordinate with the maintainer (#1149642) and secteam.
+ NOTE: 20261003: nvidia-open-gpu-kernel-modules (contrib) must move in
+ NOTE: 20261003: lockstep, as it needs firmware-nvidia-gsp (= its version);
+ NOTE: 20261003: DLA-4753-1 already broke that. (utkarsh/front-desk)
+--
openexr
NOTE: 20260413: Added by Front-Desk (rouca)
NOTE: 20260713: Also add for bookworm (Beuc/front-desk)
@@ -562,6 +574,13 @@ php-laravel-framework
NOTE: 20251027: tests is required to prevent regressions, but I could not get the upstream
NOTE: 20251027: test suite to work. It is not exercised as part of Debian packages build. (paride)
--
+php-mongodb
+ NOTE: 20261003: Added by Front-Desk (utkarsh)
+ NOTE: 20261003: CVE-2026-96745 (__pclass deserialization in command
+ NOTE: 20261003: monitoring events) affects 1.15.0 and was fixed for trixie
+ NOTE: 20261003: in DSA-6539-1. Also fix CVE-2026-84968 and CVE-2026-6811,
+ NOTE: 20261003: from the same DSA, in that upload. (utkarsh/front-desk)
+--
php8.2 (guilhem)
NOTE: 20261002: Added by Front-Desk (utkarsh)
NOTE: 20261002: All 10 CVEs fixed for trixie in DSA-6514-1 affect 8.2.33;
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e815005d25587e97a318ae877cc9c628fb538fe3...1c8d620c5e6d9516f8606f8d636da4de9777ad22
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e815005d25587e97a318ae877cc9c628fb538fe3...1c8d620c5e6d9516f8606f8d636da4de9777ad22
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/0d557b44/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list