Hi, On 01/09/26 08:16 , Salvatore Bonaccorso wrote: > Hi Abhijith, > > On Tue, Sep 01, 2026 at 09:41:58AM +0530, Abhijith PA wrote: > > Hello security team, > > > > I plan to fix open CVEs of libarchive in stable. Both CVE-2026-14164 > > and CVE-2026-15028 are marked as no-DSA. But CVE-2026-16517 is not > > yet. > > > > Shall I do a SPU fixing all three issues for the next point release > > (12 Sept.), if CVE-2026-16517 is also marked as no-DSA. > > Yes all three CVEs can be fixed via the upcoming point release. So for > us you have a go ahead that this should be done via a trixie-pu > update.
> Have you already checked with the current maintainers if they do not > want to provide themself an update in stable? No, I have not. I will ping them. --abhijith
