Free software activities in August 2026

(The rest of the report is forthcoming...)

Debian LTS

This month I have worked 28 hours on Debian Long Term Support (LTS) and on its sister Extended LTS (ELTS) project.

• Investigated and triaged: anki (CVE-2026-64677), civicrm (CVE-2026-72558, CVE-2026-72559), designate (CVE-2026-71193 & CVE-2026-71194), emacs (CVE-2026-77219), freecad (CVE-2026-34398, CVE-2026-34399, CVE-2026-34789, CVE-2026-73233, CVE-2026-73234 & CVE-2026-73235), gegl (CVE-2026-18300), golang-github-getkin-kin-openapi (CVE-2025-30153, CVE-2026-73501, CVE-2026-73502, CVE-2026-76905 & CVE-2026-77354), golang-github-go-chi-chi (CVE-2026-72817, CVE-2026-72815, CVE-2026-72816 & CVE-2025-71405), golang-golang-x-image (CVE-2026-46603), python-django (CVE-2026-15307 & CVE-2026-15830), python2.7 (CVE-2026-15806, CVE-2026-17084 & CVE-2026-18503), thunderbird (CVE-2026-74967), tika (CVE-2026-66755) and xorg-server (CVE-2026-55999 & CVE-2026-56000).

• Frontdesk duties, responding to user/developer questions, reviewing others' packages, participating in mailing list discussions, etc.

• Issued DLA 4721-1 as it was discovered that there was a potential cookie injection vulnerability (CVE-2026-55688) in async-http-client, a Java library used to make asynchronous HTTP requests.

• Issued DLA 4722-1 and ELA 17951-1 for the Redis key-value database after a potential remote-code vulnerability was discovered. In the unusual case where an authenticated attacker could execute the RESTORE command, a malicious RESTORE payload could have resulted in a double-free. (CVE-2026-66373)

• Issued DLA 4736-1 and ELA 1808-1 because two issues were discovered in Django, the Python-based web development framework:

  • CVE-2026-15337: Avoid a potential denial-of-service vulnerability in the check_for_language() method in the django.utils.translation module. This method was subject to a potential denial-of-service (DoS) attack when checking many distinct, very long language codes. To mitigate this vulnerability, language codes longer than 500 characters are now rejected before the cached lookup.

  • CVE-2026-15920: Prevent a potential cross-site scripting (XSS) attack via bogus URLField values in the Django admin. The admin renders URLField values as clickable links on 'changelist' views and read-only fields. This link was hitherto generated without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link. URLField values shown via display_for_field are now validated using the URLValidator class before a link is rendered and displayed as plain text if validation fails.

You can find out more about the Debian LTS project via the following video:

You can subscribe to new posts via email or RSS.