lldpd - Debian Package Tracker

general

source: lldpd (main)
version: 1.0.23-1
maintainer: Vincent Bernat (DMD)
std-ver: 4.1.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.11-1+deb11u2
o-o-sec: 1.0.11-1+deb11u2
oldstable: 1.0.16-1+deb12u1
old-sec: 1.0.16-1+deb12u1
stable: 1.0.18-1
testing: 1.0.23-1
unstable: 1.0.23-1

versioned links

1.0.11-1+deb11u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.16-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.18-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.23-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

liblldpctl-dev
lldpd (5 bugs: 0, 2, 3, 0)

action needed

2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:

TEMP-0000000-D6378C:

1 issue postponed or untriaged:

CVE-2026-46433: (needs triaging) lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.

Created: 2026-10-27 Last update: 2026-10-30 00:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.0.23-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit a4c5799b42e42f4bac0187ee3d13fb0264765dc7
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 07:55:35 2026 +0100

    d/tests: allow Salsa CI to skip tests
    
    Unfortunately, machine-isolation jobs are not handled...

commit 02a26db26218ff189ab2370698833e618b8a26ad
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 07:45:13 2026 +0100

    d/copyright: update and ensure it's DEP5

commit 6fd0697a47be903279beb16dde5542b5e380e146
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 07:32:50 2026 +0100

    d/tests: ensure autopkgtests pass
    
    Dunno why this is not the default?

commit d5b9e2e0ad4bad0c6b1df96c45bcc9d91fed879f
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 07:31:58 2026 +0100

    d/tests: ignore lintian warning for upstream signature

commit 1192c8fa9bb190e8441b50e5bd30fb95fa4dfb9e
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 07:14:14 2026 +0100

    d/tests: also enable ARM64 and RISC-V

commit 3e97bf71f732bf5cb9ab822e4d54c06a77093596
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 07:11:31 2026 +0100

    d/tests: enable Salsa CI

commit c5f1e2f7d9ab4ba0b696c6e6013c22776fc19113
Author: Vincent Bernat <bernat@debian.org>
Date:   Wed Oct 28 06:49:57 2026 +0100

    d/tests: add two more useful autopkgtests
    
    Tested with:
    
        sudo mmdebstrap-autopkgtest-build-qemu --boot=efi unstable ~/tmp/unstable.img
        autopkgtest ../build-area/*_1.0.23-1_*.deb . -- qemu ~/tmp/unstable.img

https://salsa.debian.org/api/v4/projects/debian%2Flldpd API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-10-28 Last update: 2026-10-28 09:04

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-14 Last update: 2026-09-14 01:02

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-46433: (needs triaging) lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.
TEMP-0000000-D6378C: (needs triaging)

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-05-15 Last update: 2026-10-30 00:30

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 1.0.23-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-26 14:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.1.1).

Created: 2018-04-10 Last update: 2026-10-26 09:20

news

[rss feed]

[2026-10-30] lldpd 1.0.23-1 MIGRATED to testing (Debian testing watch)
[2026-10-26] Accepted lldpd 1.0.23-1 (source) into unstable (Vincent Bernat)
[2026-05-23] lldpd 1.0.22-1 MIGRATED to testing (Debian testing watch)
[2026-05-14] Accepted lldpd 1.0.22-1 (source) into unstable (Vincent Bernat)
[2026-03-17] lldpd 1.0.21-1 MIGRATED to testing (Debian testing watch)
[2026-03-14] Accepted lldpd 1.0.21-1 (source) into unstable (Vincent Bernat)
[2025-08-19] lldpd 1.0.19-1 MIGRATED to testing (Debian testing watch)
[2025-08-10] Accepted lldpd 1.0.19-1 (source) into unstable (Vincent Bernat)
[2024-01-28] lldpd 1.0.18-1 MIGRATED to testing (Debian testing watch)
[2024-01-25] Accepted lldpd 1.0.18-1 (source) into unstable (Vincent Bernat)
[2023-09-26] Accepted lldpd 1.0.11-1+deb11u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2023-09-26] Accepted lldpd 1.0.16-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2023-09-25] Accepted lldpd 1.0.11-1+deb11u2 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2023-09-25] Accepted lldpd 1.0.16-1+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2023-09-22] Accepted lldpd 1.0.3-1+deb10u2 (source) into oldoldstable (Markus Koschany)
[2023-07-29] lldpd 1.0.17-1 MIGRATED to testing (Debian testing watch)
[2023-07-27] Accepted lldpd 1.0.17-1 (source) into unstable (Vincent Bernat)
[2023-04-10] Accepted lldpd 1.0.3-1+deb10u1 (source amd64) into oldstable (Chris Lamb)
[2022-11-15] lldpd 1.0.16-1 MIGRATED to testing (Debian testing watch)
[2022-11-12] Accepted lldpd 1.0.16-1 (source) into unstable (Vincent Bernat)
[2022-11-10] Accepted lldpd 1.0.15-1 (source) into unstable (Vincent Bernat)
[2022-05-28] lldpd 1.0.14-1 MIGRATED to testing (Debian testing watch)
[2022-05-25] Accepted lldpd 1.0.14-1 (source) into unstable (Vincent Bernat)
[2021-12-03] Accepted lldpd 1.0.11-1+deb11u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Vincent Bernat)
[2021-11-16] lldpd 1.0.13-1 MIGRATED to testing (Debian testing watch)
[2021-11-13] Accepted lldpd 1.0.13-1 (source) into unstable (Vincent Bernat)
[2021-08-31] lldpd 1.0.12-1 MIGRATED to testing (Debian testing watch)
[2021-08-29] Accepted lldpd 1.0.12-1 (source) into unstable (Vincent Bernat)
[2021-05-22] lldpd 1.0.11-1 MIGRATED to testing (Debian testing watch)
[2021-05-01] Accepted lldpd 1.0.11-1 (source) into unstable (Vincent Bernat)

bugs [bug history graph]

all: 5
RC: 0
I&N: 2
M&W: 3
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.0.23-1
1 bug