CVE-2025-61873: 
Linux Debian vulnerability analysis and mitigation

A critical security vulnerability identified as CVE-2025-61873 affects Best Practical Request Tracker (RT) versions 4.4 through 4.4.7 and 5.0 through 5.0.7. The vulnerability was disclosed on October 24, 2025, and impacts multiple versions of the request-tracker4 and request-tracker5 packages across various distributions (Debian Security, Ubuntu Security).

The vulnerability has received a CVSS score of 10.0 (Critical) with a vector string of (AV:N/AC:L/Au:N/C:C/I:C/A:C), indicating a severe security issue with network accessibility, low attack complexity, and no authentication required (Rapid7).

Based on the CVSS metrics, the vulnerability allows for complete compromise of system confidentiality, integrity, and availability. The critical severity rating suggests potential for significant impact on affected systems (Rapid7).

Fixed versions have been released for affected distributions. For Debian, request-tracker4 has been fixed in version 4.4.4+dfsg-2+deb11u5 for bullseye and 4.4.6+dfsg-1.1+deb12u3 for bookworm. Request-tracker5 has been fixed in version 5.0.3+dfsg-3~deb12u4 for bookworm and 5.0.7+dfsg-4+deb13u1 for trixie. The fixes are available through the respective security repositories (Debian Security).