FSF publishes incident report on GNU Savannah vulnerabilities

The Free Software Foundation (FSF) published an incident report on August 7, 2026, detailing vulnerabilities in GNU Savannah that were reported by security researchers from Hacktron in early May. The vulnerabilities, which were demonstrated via an exploit, have been resolved, and the FSF thanked Hacktron researchers Harsh Jaiswal and Rahul Maini, along with GNU volunteers Ineiev, Corwin Brust, and Bob Proulx, for their assistance.

FSF publishes incident report on GNU Savannah vulnerabilities Free Software Foundation https://www.fsf.org/author/fsfweb Contributions https://www.fsf.org/contribs/fsfweb — Published on Aug 07, 2026 05:38 PM The FSF has now published its report on the GNU Savannah vulnerabilities. In early May, security researchers from Hacktron reported vulnerabilities to the FSF affecting GNU Savannah and demonstrated an exploit. The FSF worked quickly with Hacktron to address this vulnerability and other security issues, which are now resolved. On June 19, 2026, the FSF published information https://www.fsf.org/news/statement-regarding-gnu-savannah-security-reports about the incident and committed to publishing an incident report, which can now be read here https://static.fsf.org/nosvn/security/savannah-20260807.pdf . FSF thanks Harsh Jaiswal and Rahul Maini from Hacktron https://hacktron.ai/ , along with GNU volunteers Ineiev, Corwin Brust, and Bob Proulx for their assistance in getting the vulnerabilities mitigated.