* SECURITY UPDATE: one-byte heap overflow writing an http2 ALTSVC frame - debian/patches/CVE-2026-123828.patch: size the origin buffer for the NUL that v8::String::WriteOneByte appends - CVE-2026-123828 * SECURITY UPDATE: assertion when zlib params() runs after destroy() - debian/patches/CVE-2026-123862.patch: skip the deferred parameter change when the handle is already gone - CVE-2026-123862 * SECURITY UPDATE: http2 header blocks outlived their session - debian/patches/CVE-2026-123863.patch: release the retained header block when a stream is removed and in the session destructor, and detach only strongly-held streams there; on this release line streams_ holds raw pointers, so the unguarded Detach() aborted the process - CVE-2026-123863 * SECURITY UPDATE: HTTP parser re-entered from an empty TLS write - debian/patches/CVE-2026-123864.patch: do not call ClearOut() from a zero-length write while a read cycle is in progress, and reject a parser callback that is handed a buffer it does not own - CVE-2026-123864 * SECURITY UPDATE: abandoned http2 streams survived GOAWAY(NO_ERROR) - debian/patches/CVE-2026-123865.patch: destroy them when the session is shutting down - CVE-2026-123865 * SECURITY UPDATE: http2 outbound buffers were tied to the stream lifetime - debian/patches/CVE-2026-123866.patch: retain the buffer for the lifetime of the write instead - CVE-2026-123866 * SECURITY UPDATE: SNI context CA certificates were ignored without a cert - debian/patches/CVE-2026-123867.patch: track whether a secure context carries its own CA and apply it even when the context has no certificate, so server.addContext(host, { ca }) is honoured for client certificate verification - CVE-2026-123867 * SECURITY UPDATE: inbound http2 DATA frames were not charged to the session memory limit - debian/patches/CVE-2026-123868.patch: account queued inbound DATA and consult it where the limit is enforced. Upstream's backpressure restart in OnStreamAfterWrite is ungated on this line as it is upstream, so the accounting half is what this patch closes - CVE-2026-123868 * SECURITY UPDATE: TLS resumption and renegotiation could change the SNI - debian/patches/CVE-2026-123872.patch: derive the session id context from sessionIdContext plus the server name, pin the name from the first ClientHello so renegotiation and HelloRetryRequest cannot change it, and refuse resumption for a peer-verifying server that has no session id context of its own - CVE-2026-123872 * SECURITY UPDATE: http2 streams were freed while writes were outstanding - debian/patches/CVE-2026-123874.patch: retain the stream for the lifetime of its writes - CVE-2026-123874 * SECURITY UPDATE: https Agent pooled sockets across distinct TLS policies - debian/patches/CVE-2026-123877.patch: key the Agent on the full per-request TLS policy, including sigalgs, privateKeyIdentifier and privateKeyEngine, so distinct trust or identity policies cannot share a pooled socket or a cached TLS session - CVE-2026-123877