Hi Thomas, On Sat, Oct 24, 2026 at 02:47:39PM +0200, Thomas Goirand wrote: > Package: release.debian.org > Severity: normal > Tags: trixie > X-Debbugs-Cc: [email protected] > Control: affects -1 + src:dnspython > User: [email protected] > Usertags: pu > > Hi, > > [ Reason ] > I've uploaded dnspython/2.7.0-1+deb13u1 fixing CVE-2026-114605. > > [ Impact ] > Possible DoS with current Trixie version. > > [ Tests ] > The patch adds a test, ran at package build time. > > [ Risks ] > Not much, patch is simple. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable
But at time of writing it is yet 2.8.0-6 in unstable and missing the fix. Do you have an upload pending rebasing to 2.9.0 containing the fix? Regards, Salvatore
