The Debian Project has released Debian 13.6, the sixth point update for its stable Debian 13 “trixie” distribution. This update, released on July 11, 2026, includes a collection of security fixes, critical bug corrections, and updated installation images.
It does not introduce a new version of Debian; existing systems can be upgraded to the latest revision via standard APT updates from an updated Debian mirror.
Debian 13.6 Released
Debian 13.6 consolidates packages previously issued through Debian Security Advisories (DSAs), so systems that regularly install updates from the trixie-security repository will have fewer packages to download.
The updated installer includes the fixes from this stable point release and features a Linux kernel ABI bump to version 6.12.94+deb13. Administrators can update their systems by running `apt update && apt upgrade`. At the same time, new deployments can use the updated Debian 13.6 installation media.
A significant change in this release concerns UEFI Secure Boot. Debian has updated `fwupd` to the upstream version 2.0.20, which enables firmware-mediated updates for the Secure Boot Certificate Authority (CA), Key Exchange Key (KEK), and the forbidden-signature database (DBX) data.
The CA commonly installed on PCs since 2013 has expired, posing a potential issue for boot continuity when future shim-signed updates are applied on systems with Secure Boot enabled.
Debian advises users to install OEM-provided updates for CA, KEK, and DBX before transitioning to affected Secure Boot configurations.
The release also addresses a wide range of vulnerabilities in Apache HTTP Server, including use-after-free, buffer overflows, buffer underwrites, out-of-bounds reads, arbitrary file reads, cross-site scripting, and denial-of-service flaws.
Additionally, Curl has been updated to fix credential and bearer-token leaks across redirects, stale cookie exposure, SMB use-after-free conditions, STARTTLS clear-text connection reuse, and proxy authentication-state issues.
QEMU has also been upgraded to a new upstream stable version, which includes numerous security corrections relevant to virtualized workloads.
Furthermore, Debian reverted the geoip-database to a version from around December 2019 because newer GeoLite database releases cannot be distributed under the Debian Free Software Guidelines.
Organizations that rely on accurate IP allocation and geolocation intelligence should obtain a GeoLite license directly and not depend on Debian’s repository package for current data.
Notable CVEs Fixed
- Apache2: CVE-2026-29167, CVE-2026-48913, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356, CVE-2026-42536, CVE-2026-42535, CVE-2026-44186, CVE-2026-49975, CVE-2026-43951, CVE-2026-44185, CVE-2026-44119, CVE-2026-44631
- Curl: CVE-2025-14524, CVE-2026-3783, CVE-2025-14819, CVE-2026-1965, CVE-2026-3784, CVE-2026-5545, CVE-2026-4873, CVE-2026-3805, CVE-2026-5773, CVE-2026-6253, CVE-2026-6429, CVE-2026-6276, CVE-2026-7168
- QEMU: CVE-2024-6519, CVE-2026-2243, CVE-2026-3195, CVE-2026-3196, CVE-2026-3842, CVE-2026-3886, CVE-2026-3890, CVE-2026-41435 through CVE-2026-41440, CVE-2026-5744, CVE-2026-5761, CVE-2026-5763, CVE-2026-6502, CVE-2026-8341, CVE-2026-48002 through CVE-2026-48004, CVE-2026-48914, CVE-2026-48915, CVE-2026-6425, CVE-2026-8343
- Linux kernel: Updated through multiple Debian security advisories, alongside refreshed signed AMD64 and ARM64 kernel packages.debian
- Other affected software:
dcmtk,dhcpcd,giflib,libxml2,mutt,python3.13,rsync,sshfs-fuse,xz-utils,wireshark,OpenSSL, Chromium, Firefox ESR, Nginx, Redis, PostgreSQL 17, and Thunderbird received security-related updates.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
