* SECURITY UPDATE: HTTP/2 server abort on session teardown - debian/patches/CVE-2026-123863.patch: http2: release stream headers when a stream is removed from the session - CVE-2026-123863 * SECURITY UPDATE: HTTP/2 session never cleaned up after GOAWAY and protocol error - debian/patches/CVE-2026-123865.patch: http2: detect sessions that nghttp2 terminated after a peer GOAWAY - CVE-2026-123865 * SECURITY UPDATE: HTTP/2 stream teardown sends freed response memory - debian/patches/CVE-2026-123866.patch: http2: keep write buffers alive until the socket write finishes - CVE-2026-123866 * SECURITY UPDATE: HTTP/2 use-after-free of Http2Stream with respondWithFile() - debian/patches/CVE-2026-123874.patch: http2: keep a stream alive while its writes are on the socket - CVE-2026-123874 * SECURITY UPDATE: HTTP/2 one-byte heap overflow in session.altsvc() - debian/patches/CVE-2026-123828.patch: http2: do not write a NUL terminator past the ALTSVC buffers - CVE-2026-123828 * SECURITY UPDATE: HTTPS empty TLS write re-enters the HTTP parser - debian/patches/CVE-2026-123864.patch: tls: do not read the next record on an empty write inside a TLS cycle - CVE-2026-123864 * SECURITY UPDATE: zlib params() plus destroy() throws an uncatchable assertion - debian/patches/CVE-2026-123862.patch: zlib: handle the params() callback after the stream is destroyed - CVE-2026-123862 * SECURITY UPDATE: https.Agent TLS session reuse across CA policies - debian/patches/CVE-2026-123877.patch: https: encode TLS options by type and length in the Agent key - CVE-2026-123877 * SECURITY UPDATE: HTTP/2 inbound DATA on undrained streams not limited by maxSessionMemory - debian/patches/CVE-2026-123868.patch: http2: charge inbound DATA held by paused streams to maxSessionMemory - CVE-2026-123868 * SECURITY UPDATE: CA-only SNI context falls back to the default client CA - debian/patches/CVE-2026-123867.patch: tls: apply the CA of an SNI context that has no certificate - CVE-2026-123867 * SECURITY UPDATE: TLS renegotiation, HRR or resumption can change the server name - debian/patches/CVE-2026-123872.patch: tls: pin the SNI for resumption, renegotiation and HelloRetryRequest - CVE-2026-123872