I've worked during September 2026 on the below listed packages, for
Freexian LTS/ELTS

Many thanks to Freexian and sponsors for providing this 
opportunity!

LTS:
===

 * ruby-jwt: Prepared update for bookworm and trixie fixing
   CVE-2026-45363. Released [DLA 4787-1] for bookworm.
   Sent update for trixie to security team for review.

 * memcached: Prepared update for bookworm fixing CVE-2023-46852
   CVE-2023-46853 CVE-2026-47783 CVE-2026-47784. Marked CVE-2026-90698
   not-affected for bookworm. Released [DLA 4791-1].

 * urwid: Prepared update for bookworm fixing CVE-2026-9323.
   Released [DLA 4780-1] for bookworm. Filed SPU #1148950[1]
   https://debusine.debian.net/debian/developers/work-request/1331098/

 * puma: Prepared update for trixie fixing CVE-2026-47736 and
   CVE-2026-47737 and file SPU  #1149582[2]
   https://debusine.debian.net/debian/developers/work-request/1249181/

 * libvirt: There are 7 open CVEs[3]. Backported first part of
   CVE-2025-12748[4] (Qemu part) to the bookworm version. 
   
 * rabbitmq-server: There are around 48 open CVEs[5] in the
   package. Started to stage the affecting ones first.


Continuing from previous month:

 * libarchive: Prepared update fixing CVE-2026-14164 CVE-2026-15028
   CVE-2026-16517. Created MR[6] on salsa for maintainer review.


ELTS:
====
This month I couldn't work on any packages for ELTS.

--

[DLA 4787-1] - https://lists.debian.org/debian-lts-announce/2026/09/msg00022.html
[DLA 4791-1] - https://lists.debian.org/debian-lts-announce/2026/09/msg00026.html
[DLA 4780-1] - https://lists.debian.org/debian-lts-announce/2026/09/msg00015.html
[1] - https://bugs.debian.org/1148950
[2] - https://bugs.debian.org/1149582
[3] - https://security-tracker.debian.org/tracker/source-package/libvirt
[4] - https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/message/BDJY4DZBXNSUXAI35ZS6U2LGW3KDSR2N/
[5] - https://security-tracker.debian.org/tracker/source-package/rabbitmq-server
[6] - https://salsa.debian.org/debian/libarchive/-/merge_requests/14