The security upload 8.20.0-2ubuntu4 incorrectly backported various security fixes, causing both stylistic issues breaking the tests, as well as the CVE-2026-8927 fix to be ineffective: The test case "HTTP proxy auth Digest, then change proxy and do it again" is failing when running as part of upstream- event-based- tests-openssl (after fixing the checksrc style issues so it gets to actually run the tests).
This security upload has been reverted as per 8.20.0-2ubuntu8 as we are so close to the beta freeze.
Please make sure to correctly backport the security fixes, and prepare an update with passing tests for either the post-beta or an update for the -security pocket on release day.
Please double check whether the released security updates for the stable releases are passing their test suites.
Bug watches keep track of this bug in other bug trackers.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
