Hi Xavier, On Fri, Oct 02, 2026 at 07:19:41AM +0200, Xavier wrote: > Le 02/10/2026 à 06:23, Salvatore Bonaccorso a écrit : > > Hi Xavier, > > > > On Thu, Oct 01, 2026 at 07:02:40PM +0200, Xavier Guimard wrote: > > > Package: release.debian.org > > > Severity: normal > > > Tags: trixie > > > X-Debbugs-Cc: [email protected], [email protected] > > > Control: affects -1 + src:apache2 > > > User: [email protected] > > > Usertags: pu > > > > > > [ Reason ] > > > A lot of low/medium vulnerabilities were published in apache2 version > > > 2.4.69. This project is ~LTS, so we decided to follow upstream changes > > > > We could do this as well via a DSA, but it should be exposed first in > > unstable for a while in case of reported regressions. > > > > Btw, I think CVE-2026-59685 should not be listed as this affects only > > Apache HTTP Server when using on Windows? > > > > Regards, > > Salvatore > > Hi Salvatore, > > of course I pushed it in unstable first and autopkgtest + reverse > autopkgtests looks good. However as usual we may wait a few days to see if > upstream will publish a release that fixes regressions as usual: > > - 2.4.68 (June 11th) fixed 2.4.67 regressions (June 5th) > - 2.4.65 (July 23th 2025) fixed 2.4.64 regressions (July 11th) > - 2.4.62 (July 18th 2024) fixed 2.4.61 regressions (July 3rd) > - ... > > A dozen days looks to be a good choice :-)
Ok! > CVE-2026-59685 removed from d/changelog (commit 24a09c7c) Thanks! Regards, Salvatore
