Debian does not issue a Debian Security Advisory (DSA) for every CVE. The security team tracks each CVE, assesses its impact in a Debian context and writes a DSA only for issues it considers serious. For the rest, check the Debian Security Tracker for the status and notes.
What Debian says
Debian's security FAQ states that the fact something is assigned a CVE ID does not necessarily imply a serious threat to a Debian system. Every CVE is tracked in the Debian Security Tracker. Low-impact issues that do not qualify for a DSA can be fixed in the next Debian release, in a point release of the current stable or oldstable distributions, or included in a DSA issued for a more serious vulnerability.
The FAQ also says Debian does not provide CVSS scores and does not use CVSS scores from external sources when triaging. That is a deliberate choice, so a CVSS number from your scanner will not move a Debian fix up or down.
Reading the Tracker
Each CVE has a page in the Security Tracker with a status for every Debian release and a Notes section. Look for:
- A fixed version for your release. If present, update to it.
- A note saying the issue does not warrant a security update, but may be fixed in a point release.
- A listing in dsa-needed, which is Debian's list of packages for which a security update is planned.
- No entry for your release, which can mean the package is not affected in that release.
What to do with the finding
| Tracker says | Your action |
|---|---|
| Fixed in a version you can install | Update and record the version |
| Planned, listed in dsa-needed | Track it, consider mitigation, set a review date |
| Minor, deferred to a point release | Record a risk acceptance with an owner and a date |
| Not affected | Document it, and ask the scanner owner to correct the rule |
Close each finding with evidence: the Tracker URL, the date you checked, the installed version and the decision. Auditors accept a documented, dated decision more readily than a silent suppression.
Do not wait for the DSA
A missing DSA is not permission to ignore a finding. If the CVE is in the CISA Known Exploited Vulnerabilities catalog, the question changes: is the package present and reachable on your systems? Then look for a mitigation or a replacement even without a DSA. For ordinary findings, the Tracker plus a review date is a reasonable position.
Where to send questions
Debian's FAQ says its security team will not generally answer requests about a vulnerability management tool's list of open CVEs. If your tool is wrong about the Debian status, take it to the tool's vendor, and report errors in the triage data to Debian if you find them. Debian welcomes reports of errors in its triage data.
Try it yourself
Click through it at your own pace, or open it full screen.
Open a finding and note where the fix status and owner sit. Your Tracker evidence belongs in that spot.
Safeguard combines dependency and container image scanning with policy gates, so an accepted finding can carry an expiry and a reason. Try a free scan.
Quick check
Does Debian use CVSS scores?
According to its security FAQ, no. Debian does not provide CVSS scores and does not use them from external sources for triage.
What is dsa-needed?
It is Debian's list of packages for which a security update is planned.
Sources
- Debian, Security FAQ
- Debian, Security information
- CISA, Known Exploited Vulnerabilities
Last reviewed: 19 October 2026.
