Hi all, Two more pieces of work I haven't mentioned here yet, both against bookworm.
libgit2 (CVE-2026-53583, -53584, -53585, -53586, -5917) Bookworm ships 1.5.1+ds-1+deb12u1, vulnerable to 5 real CVEs across two upstream fix batches: an inverted TLS hostname check, a submodule path-traversal gap, an unbounded packfile-delta allocation, a credential-callback host confusion on redirect, and an SSH-transport shell injection. A sixth CVE in the same batch, CVE-2026-53587, doesn't actually apply - the vulnerable code was added by a later upstream refactor that isn't in 1.5.1's smart_pkt.c. All 5 patches apply cleanly, both build variants (static and shared) build clean, and the full CTest suite passes. MR: https://salsa.debian.org/debian/libgit2/-/merge_requests/7 libwebsockets (CVE-2026-10650, CVE-2025-11678, CVE-2025-11677) Found this one sweeping dla-needed.txt for a new candidate - 3 open CVEs for bookworm's 4.1.6-3, already fixed in bullseye/trixie/sid. One thing worth flagging: the existing debian/bullseye branch's CVE-2025-11678 patch has a typo that won't compile (a missing + in the bounds check). I couldn't find 4.0.20-2+deb11u1 published anywhere, so it may just be sitting unbuilt. Fresh dpkg-source extraction plus quilt applies clean, full build and lintian clean. MR: https://salsa.debian.org/lts-team/packages/libwebsockets/-/merge_requests/1 Let me know if either needs anything from my side. Ivo
