-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Oct 2026 18:03:52 +0800
Source: varnish
Architecture: source
Version: 7.7.0-3+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Varnish Package Maintainers <team+varnish-team@tracker.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Changes:
 varnish (7.7.0-3+deb13u2) trixie-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * Backport the VSV00020 case-conversion workspace overflow fix
     (CVE-2026-93894), with regression tests.
   * Backport the complete VSV00018 absolute-form request normalization
     fix (CVE-2026-34475): validate request URLs, enable HTTPS
     normalization by default while preserving opt-out, and cover empty
     paths and query-only targets.
Checksums-Sha1:
 edf43e86aa325e8feb9cc69e74805b720f700da0 2080 varnish_7.7.0-3+deb13u2.dsc
 e8c0f3f5c5cc9d2f5e44b6f73882b87f3ef9969f 34220 varnish_7.7.0-3+deb13u2.debian.tar.xz
 e2ea281a7fb3369349a2121ba3fe6e504bd0a629 9921 varnish_7.7.0-3+deb13u2_source.buildinfo
Checksums-Sha256:
 6ba990adf51ba2946d0980f02d2fe2d1d3968e3950c2b28632587e91bd961ea4 2080 varnish_7.7.0-3+deb13u2.dsc
 e2d46b83b5dfa71caba6b0bc74cde4d423b705d0377d91d7005de975b8565caa 34220 varnish_7.7.0-3+deb13u2.debian.tar.xz
 c97462c7adc516305ca8ad590d68bbc9cf589f3039d889f8d16c8796d916f3ef 9921 varnish_7.7.0-3+deb13u2_source.buildinfo
Files:
 15b64568365df23daf251927b5407c0f 2080 web optional varnish_7.7.0-3+deb13u2.dsc
 bb3afe501d5d524fec1df09df413a581 34220 web optional varnish_7.7.0-3+deb13u2.debian.tar.xz
 946b61c8a89ee9b191a7c6ffaba4569c 9921 web optional varnish_7.7.0-3+deb13u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmrcgrAACgkQ+GQ1dHE8
m67Uywf/e3rhsTn7nxgzqD40pJs6Nb4Axkr8evE5RjHMNKQbOynzrccsNfOzSFiO
+tuEJFbsk2FuDdw9THVG1azQ93VHnpR8qvtv0lfwSlJbUs26p80bT5tWSuOVMoD/
O53vpQU+DZF4cv7eWZ7GH/uCe22eE5WfsO42HdO2zaS+zei5/GoJUUOrbXVtv+Rf
VUmXiX3INzDihq82CNAvwMirHc3e3nsVkMuJ/Ait9j5lOimdkEVeTbqXROdotLvZ
cD3apYW01rLVKhBGhl8k0oB/FXGl4vSdiRTjsFRtmegLZYSFCsgcjpNeoZOyFqa/
AcTHv5CUpLvyHJYUITT6aW1Jur1WhQ==
=lYj7
-----END PGP SIGNATURE-----