CVE-2026-96283

NameCVE-2026-96283
DescriptionBy calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6223-1
Debian Bugs1132945

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
flatpak (PTS)bookworm, bookworm (security)1.14.10-1~deb12u2fixed
trixie1.16.6-1~deb13u2fixed
trixie (security)1.16.6-1~deb13u3fixed
forky, sid1.18.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
flatpaksourcebookworm1.14.10-1~deb12u2DSA-6223-1
flatpaksource(unstable)1.16.4-11132945

Notes

https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg
Search for package or bug name: Reporting problems