Debian 13.7 Brings 100+ Security Fixes: What Admins Need to Know

Debian 13.7 has been available since September 12, 2026, and this 7th minor release brings around one hundred security fixes. Here’s what you need to know before installing it on your servers.

Two months after Debian 13.6, the Debian team has rolled out a new point release for the stable version of its distribution, namely Debian Trixie. As I wrote in July 2026 in my article on the changes in Debian 13.6, these intermediate releases are not new Debian versions: they consolidate the updates published continuously since the previous revision.

Debian also reminds us in its official announcement: "This point release mainly adds fixes for security issues, along with a few adjustments for serious problems", it says. A quick visit to the official repositories will be enough to move to this version. Debian 13.7 includes at least 107 security fixes (linked to DSA advisories) for a wide variety of packages.

Security fixes in Debian 13.7

I won’t list all 107 security vulnerabilities patched through Debian 13.7. However, some vulnerabilities are worth mentioning in this article.

• Linux kernel. 6 security advisories concern the kernel (DSA-6381, 6393, 6405, 6415, 6466 and 6477), and the Debian installer has been rebuilt so it now relies on the Linux kernel 6.12.107 ABI.
• glibc. The C library fixes two buffer overflow vulnerabilities (CVE-2026-5928 and CVE-2026-5450) and ensures compatibility with Linux kernel 7.0 headers. Following this update, many packages were recompiled with this updated glibc, including bash, zsh, busybox, gnupg2, docker.io and snapd.
• QEMU. The hypervisor gets a new stable version and fixes around twenty flaws, including a Secure Boot bypass (CVE-2026-16288).
• libvirt. 5 CVEs are patched, including a privilege escalation (CVE-2026-63622) and an information leak (CVE-2026-63623). If you virtualize on Debian with KVM, applying these patches is important.
• ImageMagick. a major update intended to patch 24 different vulnerabilities.
• Perl. Perl gets patches for a dozen CVEs, including a code execution flaw (CVE-2026-48962).

There are also updates for other packages such as dnsmasq, OpenSSL, Samba, Postfix, Exim4, BIND 9, PostgreSQL 17, Docker, and even ZFS. Not to mention Incus, which also gets an update to patch two flaws: a directory traversal (CVE-2026-81500) and insufficient access control (CVE-2026-81501).

Other changes

Beyond the security patches mentioned above, this release brings a few changes:

• RISC-V. The audit package now supports the riscv64 architecture.
• Time zones. The tzdata package has been updated with changes affecting Alberta (Canada) and Morocco.
• Browsers. Three new packages (llvm-toolchain-22, rustc-web and rust-cbindgen-web) have been added to make it possible to compile Chromium and other browsers.

As you can see, Debian has updated many packages in order to improve the security of numerous services and tools you may be likely to install on your machines. This is therefore an important update for those who rely on

How do you upgrade to Debian 13.7?

On an existing installation, the update comes down to two commands:

sudo apt update
sudo apt upgrade

If your machines already receive updates from the security.debian.org repository (which is the case for a standard installation, as the installer adds this trixie-security repository to APT’s configuration), you should not have many packages to update.

The full list of modified packages can be found in the Trixie Changelog and in this official article.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio