FSF publishes incident report on GNU Savannah vulnerabilities

The FSF has now published its report on the GNU Savannah vulnerabilities. In early May, security researchers from Hacktron reported vulnerabilities to the FSF affecting GNU Savannah and demonstrated an exploit. The FSF worked quickly with Hacktron to address this vulnerability and other security issues, which are now resolved.

On June 19, 2026, the FSF published information about the incident and committed to publishing an incident report, which can now be read here.

FSF thanks Harsh Jaiswal and Rahul Maini from Hacktron, along with GNU volunteers Ineiev, Corwin Brust, and Bob Proulx for their assistance in getting the vulnerabilities mitigated.