In the Debian security tracker, no-dsa means no security advisory is warranted for now, though a fix may arrive in a point update. Postponed means a fix is queued for a future advisory. Ignored means no update will be provided. These tags tell you whether to wait for the distribution or fix the library yourself.
Why you would look
A scanner flags a system library in your container, say a C library on Debian, and the version looks old. Before deciding what to do, you need to know whether the distribution has fixed it, plans to, or has decided not to. The tracker is the record.
What the tracker records
According to the tracker's documentation, for each CVE and source package it records the Debian version that fixes the issue, mainly for the unstable release, with per-release status shown using distribution tags. Entries carry cross references to advisory identifiers and bug numbers, plus notes.
The status tags
| Tag | Meaning | What you do |
|---|---|---|
| unfixed | No fix yet in that release | Mitigate, or fix the library yourself if the risk is high |
| not-affected | The package is not affected | Record the reason and close the alert |
| undetermined | Needs to be revisited | Watch it, do not assume safe |
| no-dsa | No advisory warranted, a fix may come in a point update | Decide whether your exposure justifies acting sooner |
| postponed | A fix is queued for a future advisory | Plan for it, apply when it arrives |
| ignored | No update will be provided | Own the risk: replace, patch or isolate |
| end-of-life | Support has ended | Move to a supported release |
Some tags apply to packages not yet in the archive or removed from it, such as itp and removed. The tracker also says that current entries do not use severity levels, and the web view shows NVD's assessment.
Turning a tag into a decision
- Read the status for your exact release, not only the newest.
- If a fixed version is listed, compare it with the installed package version, not the upstream number. Debian's security FAQ says that if your version is the same or higher than the fixed one, you should be safe from the issue.
- If the status is no-dsa, postponed or ignored, ask whether the vulnerable code path is reachable in your use. See what reachability analysis cannot tell you for the limits.
- Record the decision with a review date, so it does not become permanent by accident.
Mistakes to avoid
- Treating ignored as fixed. It means the opposite of a promise to fix.
- Closing alerts because the upstream version looks older than the fix. Backports break that logic.
- Forgetting to restart services after the update arrives.
Quick check
Does no-dsa mean the issue is harmless?
No. It means the team judged an advisory unwarranted. A fix may still come later, and your exposure may differ.
Where do I see the fixed version?
In the tracker entry for the CVE and source package, listed per release.
Safeguard's SBOM and dependency scanning can build an inventory of the components in a repository, and the free scan at gold.safeguard.sh/scan is a quick way to see what turns up.
Sources
Last reviewed: 19 October 2026.
