Hi Laszlo, No rush from my side. I'm not aware of any public exploit or of these being exploited in the wild; I only prepared the backport because the fixes were sitting unreleased on master. Waiting for 2.10 and packaging the full release makes more sense than cherry-picking, so please go ahead that way and disregard the debdiff.
Thanks for the quick reply. Regards, Sumit On Sun, Nov 01, 2026 05:24 AM, "László Böszörményi (GCS)" <[email protected]> wrote: > Hi Sumit, > > On Sat, Oct 31, 2026 at 8:17 PM Sumit Verma > <[email protected]> wrote: > > Attached is a debdiff for a 2.9.0-1.1 NMU that backports the upstream > > fixes for these four bugs from libexpat master (none of them is in a > > release yet). I have not uploaded anything; please use as much or as > > little of it as you like. > Please note that upstream constantly fixes other bugs. I do not want > to trial and error with some patches that may require additional ones > that are just added or going to be added. Then upstream plans to make > the full 2.10 release within 24 hours. > Is there any rush, public exploit of services where these bugs of > expat are exploited? > > Regards, > Laszlo/GCS >
