If I understand correctly, trixie-security contains a fixed version, however, bookworm not (yet)?
Is it going to be fixed for oldstable?
https://security-tracker.debian.org/tracker/CVE-2026-109518
bookworm-security has the fix
https://security-tracker.debian.org/tracker/CVE-2026-109518
bookworm-security has the fix