Version 4.8.4+dfsg-1 of electrum is marked for autoremoval from testing on Thu 10 Dec 2026. It depends (transitively) on debugpy, ipykernel, mistune, affected by #1145330, #1146434, #1152757. You should try to prevent the removal by fixing these RC bugs.
CVE-2026-117601:
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.
Depends on packages which need a new maintainer
normal
The packages that electrum depends on which need a new maintainer are:
![[bug history graph]](https://qa.debian.org/data/bts/graphs/e/electrum.png){kind=link}