Hi Thomas, On Sat, Oct 24, 2026 at 04:36:13PM +0200, Salvatore Bonaccorso wrote: > Hi Thomas, > > On Sat, Oct 24, 2026 at 02:47:39PM +0200, Thomas Goirand wrote: > > Package: release.debian.org > > Severity: normal > > Tags: trixie > > X-Debbugs-Cc: [email protected] > > Control: affects -1 + src:dnspython > > User: [email protected] > > Usertags: pu > > > > Hi, > > > > [ Reason ] > > I've uploaded dnspython/2.7.0-1+deb13u1 fixing CVE-2026-114605. > > > > [ Impact ] > > Possible DoS with current Trixie version. > > > > [ Tests ] > > The patch adds a test, ran at package build time. > > > > [ Risks ] > > Not much, patch is simple. > > > > [ Checklist ] > > [x] *all* changes are documented in the d/changelog > > [x] I reviewed all changes and I approve them > > [x] attach debdiff against the package in (old)stable > > [x] the issue is verified as fixed in unstable > > But at time of writing it is yet 2.8.0-6 in unstable and missing the > fix. Do you have an upload pending rebasing to 2.9.0 containing the > fix?
Friendly ping? (The fix is yet missing in unstable). Regards, Salvatore
