| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-73154 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-5g48-xjmf-7p4q: StationData::setData stack overflow |
| CVE-2026-73153 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-624p-cp8x-6hp6: EchoLink RTCP/SDES: out-of-bounds read |
| CVE-2026-73152 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-4g8q-rgxf-fmgf: EchoLink proxy: integer truncation in message length |
| CVE-2026-73151 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-x5r8-rq62-q9cj: remotetrx: unvalidated audio length + exposed transceiver control |
| CVE-2026-73150 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-4f8x-49pf-3x5v: Buffer overflow in APRS message construction |
| CVE-2026-73149 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-mh75-5pr3-qv2p: NetRx: out-of-bounds read via unvalidated MsgAudio length |
| CVE-2026-73148 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference |
| CVE-2026-73147 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-pc2g-2p95-4cr5: TCL command injection in reflector client |
| CVE-2026-73146 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-r2gm-p682-3mpm: svxreflector: use-after-free via reentrant client deletion |
| CVE-2026-73145 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-58ph-q79f-7x9x: HTTP server: unbounded request accumulation |
| CVE-2026-73144 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-qccg-7pw6-787v: FRN module: unbounded memory growth |
| CVE-2026-73143 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-38fq-mrrg-8rmr: RtlTcp: malformed greeting causes daemon exit |
| CVE-2026-73142 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-5xr9-fmm8-7p8x: remotetrx NetUplink: connection object leak DoS |
| CVE-2026-73141 | vulnerable | vulnerable (no DSA) | fixed | fixed | GHSA-xmcv-mjpv-x46q: Audio decoders: stack VLA exhaustion |