Hi Alexandru, On Wed, Sep 09, 2026 at 11:50:37AM +0300, Alexandru Mihail wrote: > Hello, I've recently fixed a CVE reported in mini-httpd, which I solely > maintain. > > CVE-2026-68005 > > https://nvd.nist.gov/vuln/detail/cve-2026-68005 > > This was fixed in: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144953 > > The problem is, the official CVE looks at upstream for changes, as it > should. Upstream is most probably dead, hasn't responded in a long while, I > am effectively the upstream maintaining this. > > How do I/Debian propagate the information that the CVE was fixed ? I don't > think this will happen automatically, since upstream won't respond to my > forwarded patches, although I will send them. > > All users still using the server are using the Debian codebase, or > derivatives.
I'm not completely sure if I understand what you are aiming for. In Debian itself we track it as https://security-tracker.debian.org/tracker/CVE-2026-68005 I assume you wanted to add a note that in Debian the CVE is referenced by https://bugs.debian.org/1144953 ? Then you can via https://cveform.mitre.org ask to update references and add a reference to the Debian bug as well. Does this help? Regards, Salvatore
