lexbor - Debian Package Tracker

general

source: lexbor (main)
version: 2.6.0-2
maintainer: Karsten Schöke (DMD) (DM)
arch: any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 2.6.0-2
unstable: 2.6.0-2

versioned links

2.6.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

liblexbor-dev
liblexbor2

action needed

Marked for autoremoval on 27 April: #1130747 high

Version 2.6.0-2 of lexbor is marked for autoremoval from testing on Mon 27 Apr 2026. It is affected by #1130747. The removal of lexbor will also cause the removal of (transitive) reverse dependency: python-selectolax. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-03-21 Last update: 2026-04-04 08:32

A new upstream version is available: 3.0.0 high

A new upstream version 3.0.0 is available, you should consider packaging it.

Created: 2026-03-14 Last update: 2026-04-04 08:31

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-29078: Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
CVE-2026-29079: Lexbor is a web browser engine library. Prior to 2.7.0, a type‑confusion vulnerability exists in Lexbor’s HTML fragment parser. When ns = UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the qualified_name field. That corrupted value is later used as a pointer and dereferenced near the zero page. This vulnerability is fixed in 2.7.0.

Created: 2026-03-14 Last update: 2026-03-14 21:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-29078: Lexbor is a web browser engine library. Prior to 2.7.0, the ISO‑2022‑JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an out‑of‑bounds read from the stack and an out‑of‑bounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
CVE-2026-29079: Lexbor is a web browser engine library. Prior to 2.7.0, a type‑confusion vulnerability exists in Lexbor’s HTML fragment parser. When ns = UNDEF, a comment is created using the “unknown element” constructor. The comment’s data are written into the element’s fields via an unsafe cast, corrupting the qualified_name field. That corrupted value is later used as a pointer and dereferenced near the zero page. This vulnerability is fixed in 2.7.0.

Created: 2026-03-14 Last update: 2026-03-14 21:00

lintian reports 7 errors high

Lintian reports 7 errors about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-03 Last update: 2026-03-03 19:31

7 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 0ed385c15ae6fd1863085dcd4b2a2efc17613a01
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 12:39:39 2026 +0200

    insert hardening-no-fortify-function lintian-override

commit 140a54d67c6a77568d2474692a8d3f1a17564698
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 09:53:47 2026 +0200

    d/control: Bump Standards-Version to 4.7.4

commit a1f4034d72930691d086885ad0e14661666e82b0
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 09:47:56 2026 +0200

    change from liblexbor2 to liblexbor3

commit 79689ed23a6fa281efddbe37f44b4dd3ac116a89
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 09:35:39 2026 +0200

    d/liblexbor-dev.install: .pc file is now delivered from upstream.

commit 7b309fcad4229bbb2353c08a26b1424ff21a3c97
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 09:33:13 2026 +0200

    d/copyright: Adjustment to the current year

commit af17e582fa95dcc828e40e57366d06d20eadff16
Merge: 9baf2e1 b3f7969
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 07:25:18 2026 +0200

    Update upstream source from tag 'upstream/3.0.0'
    
    Update to upstream version '3.0.0'
    with Debian dir 62d51a7ab6e7dbb53dafe0debfe4f262a0bb8edf

commit b3f7969ef1854dbf5bfa1b35b78b52a30cd3f282
Author: Karsten Schöke <karsten.schoeke@geobasis-bb.de>
Date:   Wed Apr 1 07:24:41 2026 +0200

    New upstream version 3.0.0

Created: 2026-04-01 Last update: 2026-04-01 15:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-03-04] lexbor 2.6.0-2 MIGRATED to testing (Debian testing watch)
[2026-03-02] Accepted lexbor 2.6.0-2 (source) into unstable (Karsten Schöke)
[2026-02-01] lexbor 2.6.0-1 MIGRATED to testing (Debian testing watch)
[2026-01-29] Accepted lexbor 2.6.0-1 (source amd64) into unstable (Debian FTP Masters) (signed by: Carsten Schoenert)

bugs [bug history graph]

all: 1
RC: 1
I&N: 0
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (7, 0)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.6.0-1