Free software activities in October 2026

Here is my monthly update covering what I have been doing in the free software world during October 2026 (previous month).

Reproducible Builds

One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.

This month, I:

• Kept isdebianreproducibleyet.com up to date. [...]

• Submitted a large number of patches to fix reproducibility-related issues within Debian, including ones in complexity, golang-github-anacrolix-log, js8call, kicad-library-utils, node-uplot, php-nesbot-carbon, python-poetry-dynamic-versioning, pywps & ros-dynamic-reconfigure.

• Through reproducibility testing, I also discovered that the openstack-pkg-tools package is actually completely empty (!) if nocheck specified. (#1150097)

• Drafted, published and publicised our monthly report for September 2026.

• Categorised a large number of packages and issues in the Reproducible Builds notes.git repository.

diffoscope

Elsewhere in our tooling, I made the following changes to diffoscope, including preparing and uploading versions 333, 334, 335 and 336 to Debian:

• New features:

  • Support the dumppdf binary being called dumppdf.py on the host/runtime system. [...]

• Bug fixes:

  • Drop Recommends: guix from the diffoscope-minimal package as it is not minimal. (#1114739) [...]
  • Fix a crash when using the latest version(s) of Androguard. Thanks, hc! [...]

• Codebase improvements:

  • Re-order various parts of the .tar file comparator to make it easier to progressively delve into its functionality. [...]
  • Fix a silly "prepend" typo. [...]
  • Reflect in the Python packaging that the use of the case-match language feature necesarily requires Python 3.10+. [...]

• Misc:

  • Update debian/tests/control. [...]
  • Update copyright years. [...]

Debian

• bfs (4.1.5-1) — New upstream release.

• python-django:

  • 5.2.18-1 — New upstream security release.
  • 5.2.18-2 — Adjust the scaling factor in the test for CVE-2025-64460 added in 3:4.2.27-0+deb13u1 as it causes flakiness on loaded machines, and in particular, on the runners for autopkgtests. (#1126323)
  • 6.1.2-1 — New upstream security release.

Debian LTS

This month I have worked 30 hours on Debian Long Term Support (LTS) and on its sister Extended LTS (ELTS) project.

• Investigated and triaged aide, cpp-httplib (CVE-2025-53628), devil (CVE-2017-20286), eog (CVE-2026-107651, etc.), expat (CVE-2026-113351), gst-plugins-good1.0 (CVE-2026-111183), gst-plugins-good1.0 (CVE-2026-111183), guava-libraries (CVE-2026-102554), jackson-core (CVE-2026-89425), janus (CVE-2026-108830), json-smart (CVE-2026-113602), libarchive (CVE-2026-17591), libhibernate-validator-java (CVE-2026-93879), libhibernate-validator4-java (CVE-2026-93879), libimager-perl (CVE-2026-112202), libnfs (CVE-2026-108985), libsixel (CVE-2026-110601), luksmeta (CVE-2026-111555), m17n-lib (CVE-2026-109854), mopidy (CVE-2026-111925), mutter (CVE-2026-108094), nltk (CVE-2026-109956), node-ajv (CVE-2026-110095), node-n3 (CVE-2026-109563), pillow (CVE-2026-112390 & CVE-2026-112391), python-django (CVE-2026-84429, CVE-2026-87890, etc.), python-scp (CVE-2026-109152), rebar3 (CVE-2026-105274), rlottie (CVE-2026-108978), roundcube, vifm (CVE-2026-110237) and zaqar (CVE-2026-107363)

• Issued DLA 4843-1 and ELA 1851-1 because two vulnerabilities were discovered in Django, the popular Python web-development framework:

  • [CVE-2026-77050](https://security-tracker.debian.org/tracker/CVE-2026-77050): Potential denial-of-service vulnerability in get_supported_language_variant. This method was subject to a potential denial-of-service attack when processing many distinct and very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, potentially consuming excessive process memory. To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup.

  • [CVE-2026-87975](https://security-tracker.debian.org/tracker/CVE-2026-87975): Prevent privilege abuse in model formsets with editable primary keys. Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model's primary key could be set through the form, such as with a OneToOneField (or parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key were not affected.

• Issued DLA 4874-1 and ELA 1877-1 to address two related vulnerabilities Eye of GNOME (eog), the lightweight image viewer:

  • CVE-2026-107651: A heap-based buffer overflow existed in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could have exploited this flaw by enticing a user into opening a specially crafted .png file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via crashing the application.

  • CVE-2026-118475: When parsing a specially crafted PNG image containing malformed color profile metadata, eog failed to validate chunk boundaries while searching for a null terminator. An attacker could have tricked a user into opening a malicious image, causing the application to read past the allocated buffer. This issue could also have led to an application crash, resulting in a Denial of Service (DoS) or potentially exposing sensitive memory contents.

  (Due to an infrastructure issue, the DLA announcement mail was sent a few hours after the ELA, ultimately resulting it being dated 'November'.)

You can find out more about the Debian LTS project via the following video:

You can subscribe to new posts via email or RSS.