# lxml security updates

Patch Radar has 17 security fixes for lxml, closing 6 CVEs. The newest is DEBIAN-CVE-2026-49825 (6.1.3-1), released September 14, 2026.

- Web page: https://patchblox.com/security/product/linux/lxml
- Platform: Linux
- Supported: yes

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [DEBIAN-CVE-2026-49825](https://patchblox.com/security/data/fix/linux/debian-cve-2026-49825.md) | Sep 14, 2026 | Debian 14 6.1.3-1 | High | 1 | 0 |
| [DEBIAN-CVE-2026-49825](https://patchblox.com/security/data/fix/linux/debian-cve-2026-49825.md) | Sep 14, 2026 | Debian 12.15 (bookworm) 4.9.2-1+deb12u1 | High | 1 | 0 |
| [DEBIAN-CVE-2026-41066](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41066.md) | May 15, 2026 | Debian 14 6.1.0-1 | High | 1 | 0 |
| [DEBIAN-CVE-2026-41066](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41066.md) | May 15, 2026 | Debian 12.15 (bookworm) 4.9.2-1+deb12u1 | High | 1 | 0 |
| [DEBIAN-CVE-2026-28350](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28350.md) | Mar 5, 2026 | Debian 12.15 (bookworm) 4.9.2-1+deb12u1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-28350](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28350.md) | Mar 5, 2026 | Debian 13.5 (trixie) 5.2.0-1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-28350](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28350.md) | Mar 5, 2026 | Debian 14 5.2.0-1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-28348](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28348.md) | Mar 5, 2026 | Debian 12.15 (bookworm) 4.9.2-1+deb12u1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-28348](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28348.md) | Mar 5, 2026 | Debian 13.5 (trixie) 5.2.0-1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-28348](https://patchblox.com/security/data/fix/linux/debian-cve-2026-28348.md) | Mar 5, 2026 | Debian 14 5.2.0-1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2022-2309](https://patchblox.com/security/data/fix/linux/debian-cve-2022-2309.md) | Jul 5, 2022 | Debian 12.15 (bookworm) 4.9.1-1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-2309](https://patchblox.com/security/data/fix/linux/debian-cve-2022-2309.md) | Jul 5, 2022 | Debian 13.5 (trixie) 4.9.1-1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-2309](https://patchblox.com/security/data/fix/linux/debian-cve-2022-2309.md) | Jul 5, 2022 | Debian 14 4.9.1-1 | High | 1 | 0 |
| [DSA-5043-1](https://patchblox.com/security/data/fix/linux/dsa-5043-1.md) | Jan 12, 2022 | Debian 11.6 (bullseye) 4.6.3+dfsg-0.1+deb11u1 | High | 1 | 0 |
| [DEBIAN-CVE-2021-43818](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43818.md) | Dec 13, 2021 | Debian 12.15 (bookworm) 4.7.1-1 | High | 1 | 0 |
| [DEBIAN-CVE-2021-43818](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43818.md) | Dec 13, 2021 | Debian 13.5 (trixie) 4.7.1-1 | High | 1 | 0 |
| [DEBIAN-CVE-2021-43818](https://patchblox.com/security/data/fix/linux/debian-cve-2021-43818.md) | Dec 13, 2021 | Debian 14 4.7.1-1 | High | 1 | 0 |

---

Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo