Free software activities in September 2026

Here is my monthly update covering what I have been doing in the free software world during September 2026 (previous month).

Reproducible Builds

One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.

This month, I:

• Kept isdebianreproducibleyet.com up to date. [...]

• Submitted a significant number of patches to fix specific reproducibility issues. This includes patches for golang-forgejo-xorm-xorm, golang-github-miekg-pkcs11, lemonade, python-eventlet, python-mne, python-prov, python-vermin & yuzu.

• Reproducibility testing also uncovered an issue in lektor where temporary testing files were not removed after test suite. (#1146687)

• Categorised a large number of packages and issues in the Reproducible Builds notes.git repository.

• Updated the main Reproducible Builds website and documentation to:

  • Added a note re. TZ=UTC vs. TZ=UTC0 to the Timezones page. […][…][…]
  • Make a bunch of cosmetic updates to Jochen's supporter spotlight. […]

• Drafted, published and publicised our monthly report for August 2026.

diffoscope

This month, I made a number of changes to diffoscope, including preparing and uploading versions 330, 331 and 332 to Debian. In particular, Chris committed support for radare2 versions greater than 5.9.0 […] based on input from Guillaume Girol […], and committed support for .nar files via Guix. […][…].

I later modified diffoscope to not Build-Depend on the Debian package of GNU Guix, as its status in the Debian bug tracking system would transitively render diffoscope as being overly buggy for the next stable release […]. Similarly, he adjusted the Build-Depends on the apksigcopier package as it has been removed from Debian testing […] and, finally, he updated a number of copyright years […][…].

Debian LTS

This month I have worked 30 hours on Debian Long Term Support (LTS) and on its sister Extended LTS (ELTS) project.

• Issued both DLA 4794-1 and ELA-1831-1 for the Redis key/value database to fix two different CVEs. Specifically:

  • CVE-2026-81934: Prevent a use-after-free vulnerability in the handling of pending TLS data. A remote, unauthenticated attacker may have been able to execute arbitrary commands with the privileges of the Redis server.

  • CVE-2026-92925: Prevent an out-of-bounds vulnerability in the handling of cluster ping extensions. This could have allowed a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload was processed.

• Issued DLA 4802-1 and ELA-1835-1 for the Django web development framework in order to address multiple vulnerabilities:

  • CVE-2026-48587: Potential exposure of private data via whitespace padding in the Vary header. UpdateCacheMiddleware incorrectly cached responses whose Vary header values contained leading or trailing whitespace. Because has_vary_header failed to strip that whitespace, a response with a "Vary: *" header (note the trailing space) was not recognized as containing the wildcard, causing it to be stored and potentially served from the cache when it should not have been. (stretch and buster only)

  • CVE-2026-48588: UpdateCacheMiddleware and the @cache_page decorator cached responses that vary on cookies when the incoming request carried unrelated cookies which allowed remote attackers to read private data from the shared cache.

  • CVE-2026-53877: django.contrib.gis.gdal.GDALRaster over-read its in-memory buffer when constructed from a bytes object, which could disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsi_buffer property is accessed. (bullseye only)

• Frontdesk duties, responding to user/developer questions, reviewing others' packages, participating in mailing list discussions, etc.

• Investigated and triaged redis (CVE-2026-81934 and CVE-2026-92925).

• Finally, I uploaded both redis version 5:8.0.6-3 and python-django version 3:6.1.1-1 to Debian unstable.

You can find out more about the Debian LTS project via the following video:

You can subscribe to new posts via email or RSS.