Back Linuxsecurity Debian Roundcube Important CSS Injection Threat DSA-6137-1 CVE-2026
For the oldstable distribution (bookworm), these problems have been fixed in version 1.6.5+dfsg-1+deb12u7. For the stable distribution (trixie), these problems have been fixed in version 1.6.13+dfsg-0+deb13u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: Further information Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at:
For the oldstable distribution (bookworm), these problems have been fixed in version 1.6.5+dfsg-1+deb12u7. For the stable distribution (trixie), these problems have been fixed in version 1.6.13+dfsg-0+deb13u1. We recommend that you upgrade your roundcube packages. For the detailed security status of roundcube please refer to its security tracker page at: Further information Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
