The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (https://www.freexian.com/lts/debian/), is pleased to report its activities for September.
Activity summary
During the month of September, 20 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).
The team released 41 DLAs fixing 1854 CVEs.
In September, the Debian LTS Team was back to focusing on a single release: Debian 12 (“bookworm”). Debian 11 (“bullseye”) reached the end of its Long Term Support on 31 August 2026, and Freexian now provides its security maintenance under the Extended LTS offer.
It is important to highlight the hard work done behind the scenes of the Front
Desk fellows, whose role was fulfilled during September by Emilio, Emmanuel,
Sylvain, Thorsten and Utkarsh.
Besides the very high activity doing daily triage on dozens of packages and
CVEs, Front Desk fellows spent much of their time answering questions and
coordinating with people outside the Freexian team about update proposals.
The team published several notable updates:
- jbig2dec (DLA-4779-1), prepared by Andreas Henriksson, fixes CVE-2026-38076, where missing input checks could lead to a denial of service. It is to note that this library is used by different tools, such as ghostscript.
- linux-6.12 (DLA-4788-1), uploaded by Ben Hutching, fixing 414 CVEs in the bookworm backport of Linux kernel version 6.12.
- lxml (DLA-4799-1), prepared by Guilhem Moulin, fixes four vulnerabilities in this widely used python XML/HTML library. The issues may yield to exposing local files.
- nginx (DLA-4784-1), issued by Carlos Melara Lima (“charles”), fixing three memory-safety bugs in this popular web server and reverse proxy, which may result in denial of service, memory disclosure or potentially the execution of arbitrary code.
- openssl (DLA-4795-1), by Arnaud Rebillout, fixing six vulnerabilities, including an out-of-bounds heap write in CMS decryption and an authentication tag verification bypass in ChaCha20-Poly1305/AES-OCB decryption. This update brings bookworm to OpenSSL 3.0.22, the last upstream release of the 3.0 series, which was reached its upstream EOL on 7 Sep 2026. Further fixes will be backported by the Debian LTS Team from more recent releases.
- redis DLA-4794-1, by Chris Lamb, fixing vulnerabilities that could yield to arbitrary code execution
Contributions from other Debian fellows beyond the Freexian LTS Team:
- Thomas Goirand, Keystone released by Emilio as DLA-4767-1
- Thomas also prepared glance and swift updates, whose respective DLA-4800-1 and DLA-4801-1 were issued by Charles
- Matthew Vernon uploaded a pcre2 security update, and Emilio issued its DLA-4772-1
- Otto Kekäläinen uploaded a xz-utils update, released as DLA-4783-1 by Sylvain
- Salvatore Bonaccorso published a linux (6.1) update released as DLA-4777-1
- Xavier Guimard prepared a lemonldap-ng, released as DLA-4797-1. Additionally, Sylvain sent DLA-4734-1 at the beginning of the month for the upload made on August.
- Xavier also released DLA-4766-1 for cyrus-imapd.
- Simon Quigley uploaded DLA-4803-1 to fix multiple issues in ruby-oj.
- Finally, Ivo Marino proposed bookworm updates for cjose, git-lfs, caddy, libgit2, libwebsockets, libssh and unbound. Some of Ivo’s proposals are still pending for a review.
Thank you so much to the developers above for these valuable contributions.
The LTS Team has also contributed with updates to the latest Debian releases for the following packages:
- ruby-jwt, prepared by Abhijith and released as DSA-6547-1
- urwid, proposed for a point-release update by Abhijith (#1148950)
- puma, proposed for a point-release update by Abhijith (#1149582)
- tomcat10, and tomcat9 (which is actually backported to released suites) by Bastien
- nodejs, prepared by Bastien and released as (DSA-6517-1).
If you benefit from Debian, especially throughout its full 5-year lifecycle, please consider becoming a sponsor of Debian LTS. You can find more information here: https://www.freexian.com/lts/extended/.
Individual Debian LTS contributor reports
- Abhijith PA
- Andreas Henriksson
- Andrej Shadura
- Arnaud Rebillout
- Bastien Roucariès
- Ben Hutchings
- Carlos Henrique Lima Melara
- Chris Lamb
- Daniel Leidert
- Emmanuel Arias
- Emilio Pozuelo Monfort
- Guilhem Moulin
- Jochen Sprickerhof
- Lee Garrett
- Lucas Kanashiro
- Santiago Ruano Rincón
- Sylvain Beucler
- Thorsten Alteholz
- Tobias Frost
- Utkarsh Gupta
Thanks to our sponsors
Sponsors that joined recently are in bold.
- Platinum sponsors:
- Toshiba Corporation (for 132 months)
- Civil Infrastructure Platform (CIP) (for 100 months)
- VyOS Inc (for 65 months)
- Gold sponsors:
- F. Hoffmann-La Roche AG (for 143 months)
- CONET Deutschland GmbH (for 126 months)
- University of Oxford (for 83 months)
- EDF SA (for 54 months)
- Dataport AöR (for 29 months)
- CERN (for 27 months)
- Silver sponsors:
- Domeneshop AS (for 147 months)
- Nantes Métropole (for 141 months)
- Akamai - Linode (for 137 months)
- Univention GmbH (for 133 months)
- Université Jean Monnet de St Etienne (for 133 months)
- Ribbon Communications Operating Company, Inc. (for 127 months)
- Exonet B.V. (for 117 months)
- Leibniz Rechenzentrum (for 111 months)
- Ministère de l’Europe et des Affaires Étrangères (for 95 months)
- Dinahosting SL (for 82 months)
- Upsun Formerly Platform.sh (for 77 months)
- Moxa Inc. (for 71 months)
- sipgate GmbH (for 68 months)
- OVH US LLC (for 66 months)
- Tilburg University (for 66 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 57 months)
- THINline s.r.o. (for 30 months)
- Copenhagen Airports A/S (for 24 months)
- Conseil Départemental de l’Isère (for 10 months)
- CEOS GmbH
- Bronze sponsors:
- Seznam.cz, a.s. (for 148 months)
- Evolix (for 147 months)
- Linuxhotel GmbH (for 145 months)
- Intevation GmbH (for 144 months)
- WAAYS (for 143 months)
- Megaspace Internet Services GmbH (for 142 months)
- Greenbone AG (for 141 months)
- NUMLOG (for 141 months)
- WinGo AG (for 140 months)
- Entr’ouvert (for 132 months)
- Adfinis AG (for 129 months)
- Plat’Home (for 126 months)
- Tesorion (for 124 months)
- Bearstech (for 116 months)
- LiHAS (for 115 months)
- Demarcq SAS (for 104 months)
- Université Grenoble Alpes (for 90 months)
- TouchWeb SAS (for 82 months)
- SPiN AG (for 79 months)
- CoreFiling (for 75 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 66 months)
- Tem Innovations GmbH (for 61 months)
- WordFinder.pro (for 61 months)
- CNRS DT INSU Résif (for 60 months)
- Alter Way (for 53 months)
- SOBIS Software GmbH (for 27 months)
- Tuxera Inc. (for 19 months)
- OPM-OP AS (for 10 months)
- LU-CIX Management G.I.E. (for 3 months)