Debian's releases page lists Debian 11 Bullseye with its end of life date in August 2024 and the end of Long Term Support (LTS) on 31 August 2026. That date has passed. Any later coverage comes from third-party extended LTS, so check your arrangement before assuming fixes.
What the Debian releases page says
The Debian releases page describes a five year release life cycle: three years of full support followed by two years of LTS. Its table has columns for release date, end of life, end of LTS and end of ELTS, where ELTS means third-party paid extended LTS.
For Bullseye, the table lists a release date of 14 August 2021, end of life on 14 August 2024, end of LTS on 31 August 2026, and an extended LTS date of 30 June 2031. The status text beside it still reads "under LTS support", so the page and its own dates did not agree on the day we checked. When a status label and a date conflict, trust the date and recheck the page later.
For comparison, the same table lists Debian 12 Bookworm with end of life on 11 July 2026 and LTS to 30 June 2028, and Debian 13 Trixie with end of life on 9 August 2028 and LTS to 30 June 2030.
Three terms, three different promises
| Term | Who provides it | What to record |
|---|---|---|
| Full support | The Debian project | Supported |
| LTS | The Debian LTS effort, with a scope set on its wiki | Reduced support, with an end date |
| ELTS | Third party, paid | Extended, only if you hold a contract |
LTS is not the same as full support. Its scope is defined on the Debian LTS wiki, so do not assume that every package in your image is covered. Read that page for the current scope before you rely on it.
Why this matters for container images
Many container base images are Debian underneath. An image tagged with the Bullseye codename or built from it carries Debian 11 packages. Scanners then report vulnerabilities in those packages, and your answer to "is there a fix" depends on whether the Debian security team or LTS still publishes one. How to check if your base image operating system is end of life covers detection, and Debian version numbers that look vulnerable but are backported covers a related confusion.
A quick way to read the OS in an image is the os-release file at /etc/os-release, which reports the version and codename. Record that value next to the image name.
What to do this week
- List images and hosts that report Debian 11.
- Move what you can to a current release. Rebuilding from a newer base is usually the cleanest fix.
- For what cannot move yet, record the owner, a target date and whether you hold paid extended coverage.
- Reduce exposure for those systems: fewer open ports, no internet access where possible.
Put the date of your last check in the record. A support table changes, and a status label can lag.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how the scan reads the operating system layer, which is where a Debian version shows up.
Where Safeguard fits
Safeguard scans container images and builds SBOMs that list OS packages, and its policies and gates can encode what your team accepts. Try the free scan at gold.safeguard.sh/scan.
Quick check
Is Debian 11 still getting security updates?
Per Debian's table, LTS ended on 31 August 2026. Only paid third-party extended coverage is listed beyond it.
Does LTS cover every package?
Do not assume so. Its scope is defined on the Debian LTS wiki, so check it.
Sources
Last reviewed: 19 October 2026.
