Hi Utkarsh,
On 16/09/2026 17:03, Ivo Marino wrote:
One
thing worth flagging: the existing debian/bullseye branch's
CVE-2025-11678 patch has a typo that won't compile (a missing + in the
bounds check).
Indeed your patch has invalid C syntax "(ll + 2 readsize)":
https://salsa.debian.org/lts-team/packages/libwebsockets/-/commit/c73b14d2bd5498617d5b9c35b5973c49ede68f19
but AFAICS the impacted code doesn't get compiled without defining
LWS_WITH_SYS_ASYNC_DNS, and the build still succeeded.
Can you tidy the Salsa repository and possibly the CVE-2025-11678 triage?
Cheers!
Sylvain Beucler
Debian LTS Team
