Reporting CVE as fixed back to authority

[Alexandru Mihail]

Hello, I've recently fixed a CVE reported in mini-httpd, which I solely maintain.

CVE-2026-68005

https://nvd.nist.gov/vuln/detail/cve-2026-68005

This was fixed in: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144953








Thanks,

Alexandru Mihail

The problem is, the official CVE looks at upstream for changes, as it should. Upstream is most probably dead, hasn't responded in a long while, I am effectively the upstream maintaining this. How do I/Debian propagate the information that the CVE was fixed ? I don't think this will happen automatically, since upstream won't respond to my forwarded patches, although I will send them. All users still using the server are using the Debian codebase, or derivatives.

OpenPGP_signature.asc
Description: OpenPGP digital signature