The Debian 11 (Bullseye) security repository currently appears to be inconsistent.

The package index published under:

http://security.debian.org/debian-security/dists/bullseye-security/main/binary-amd64/Packages.gz


contains package entries whose Filename fields point to package files that are not present on the server.

For example:

Package: linux-image-amd64
Version: 5.10.262-1
Filename: pool/updates/main/l/linux-signed-amd64/linux-image-amd64_5.10.262-1_amd64.deb


However, fetching the referenced file returns HTTP 404:

wget -S -O /dev/null \
http://security.debian.org/debian-security/pool/updates/main/l/linux-signed-amd64/linux-image-amd64_5.10.262-1_amd64.deb
Show more lines

Result:

HTTP/1.1 404 Not Found


The same issue was observed for additional packages:

pool/updates/main/g/grub2/grub-common_2.06-3~deb11u7_amd64.deb
pool/updates/main/n/nss/libnss3_3.61-1+deb11u7_amd64.deb
pool/updates/main/p/python-httplib2/python3-httplib2_0.18.1-3+deb11u1_all.deb


All of the above are referenced in the published package metadata but return HTTP 404 when requested directly from security.debian.org.

At the same time, other packages from the same repository are downloadable successfully, for example:

pool/updates/main/l/linux-signed-amd64/linux-image-5.10.0-46-amd64_5.10.262-1_amd64.deb


This leads to upgrade failures such as:

E: Failed to fetch ... 404 Not Found
E: Unable to fetch some archives


Additionally, the currently published InRelease file contains:

Date: Mon, 31 Aug 2026 21:13:04 UTC
Valid-Until: Mon, 07 Sep 2026 21:13:04 UTC


which is already expired.

Best regards