A suffix like +deb12u1 marks a stable update for Debian 12: the first update uploaded after release, built on the same upstream version. The u number rises with each stable upload. In a scan it tells you a package carries Debian's fix without moving to a new upstream release.
The convention, from the policy
Debian policy says the revision part of a version can end in debNuX for a stable update. N is the major number of the stable release the package was uploaded to, and X starts at 1 and increases for every stable upload of that package. A plus or a tilde comes before the string, depending on how the update was made.
The policy lists three cases for non-native packages.
| Case | Revision ends in | Meaning |
|---|---|---|
| Same upstream version as the release | +debNuX | Original package version plus a stable update |
| New upstream version taken from unstable | ~debNuX | Portion before the tilde is the unstable version it is based on |
| New upstream version not from unstable | 0+debNuX | Upstream version, then dash zero, then the stable suffix |
So 2.36-9+deb12u4 reads as: package 2.36, Debian revision 9, with four stable updates on Debian 12. A bare 2.36-9 would be the original release build.
Why scanners care
Scanners compare the installed version to the fixed version in the distribution's data. A fix for a CVE usually arrives as the next u number. If you see deb12u3 installed and the fixed version is deb12u4, one more stable update is needed. If installed is deb12u5, it is past the fix.
This is also why upstream version numbers mislead. The upstream part may look old and vulnerable while the suffix shows the patch is in. Read backported fixes explained for that case.
Other suffixes you may meet
The same policy section describes a few more markers:
- A revision ending in a period and a number can mean a non-maintainer upload.
- A plus b and a number marks a binary rebuild with no source change.
- A plus really in the upstream part means a newer upstream was rolled back, and the text after it is the true upstream version.
None of these change the comparison rules. The package manager still compares epoch, then upstream, then revision.
A quick workflow
- Copy the installed and fixed versions from the finding.
- Read the suffix to learn the release they belong to. A
deb11string in a Debian 12 image is a sign of a mismatch worth checking. - Confirm with the package manager's own comparison.
- Rebuild on a fresh base image if the installed one is lower.
dpkg --compare-versions 2.36-9+deb12u3 lt 2.36-9+deb12u4 && echo "fix needed"
Other distributions use their own schemes, so do not apply Debian's rules to an Alpine or Red Hat based image. See debian security tracker statuses for how Debian records what is and is not fixed.
Quick check
Does u1 mean the package has one known vulnerability?
No. It counts stable uploads of that package, which may fix bugs as well as security issues.
Can the same suffix appear on Ubuntu?
Ubuntu uses its own suffix conventions. Treat Debian's policy as the rule for Debian images alone.
Sources
Last reviewed: 19 October 2026.
