Hi Abhijith, On Tue, Sep 01, 2026 at 09:41:58AM +0530, Abhijith PA wrote: > Hello security team, > > I plan to fix open CVEs of libarchive in stable. Both CVE-2026-14164 > and CVE-2026-15028 are marked as no-DSA. But CVE-2026-16517 is not > yet. > > Shall I do a SPU fixing all three issues for the next point release > (12 Sept.), if CVE-2026-16517 is also marked as no-DSA.
Yes all three CVEs can be fixed via the upcoming point release. So for us you have a go ahead that this should be done via a trixie-pu update. Have you already checked with the current maintainers if they do not want to provide themself an update in stable? Regards, Salvatore
