Hi, On Sat, Nov 07, 2026 at 05:30:23PM -0800, Collin Funk wrote: > "Nawaf Al-Thurwi" <[email protected]> writes: > > > Request: please allocate CVEs for both (Debian is well placed as > > coordinator; upstream was informed of nothing publicly and the fixes have > > no referenced reporter), backport to trixie/sid, and credit as above. > > Coordinated disclosure: I will not publish until you say go. > > You sent this to [email protected], which is a public mailing list. If > these issues are real (I have not looked), then they are already public.
FWIW, if they are validated to have security impact, then please request yourself CVEs from MITRE instead. Debian as CNA won't and can't assign CVEs, the request would be out of scope for the CNA, which is for Debian specific issues only. Regards, Salvatore
