* SECURITY UPDATE: HTTP/2 stream headers outlive the session and abort it - debian/patches/CVE-2026-123863.patch: release the stream headers in RemoveStream() - CVE-2026-123863 * SECURITY UPDATE: HTTP/2 session never cleaned up after a protocol error during shutdown - debian/patches/CVE-2026-123865.patch: detect streams abandoned by nghttp2 - CVE-2026-123865 * SECURITY UPDATE: HTTP/2 stream teardown sends freed response memory - debian/patches/CVE-2026-123866.patch: retain write buffers until the socket write finishes - CVE-2026-123866 * SECURITY UPDATE: use-after-free of Http2Stream with a pending respondWithFile() write - debian/patches/CVE-2026-123874.patch: retain the stream with each outgoing DATA buffer - CVE-2026-123874 * SECURITY UPDATE: one-byte heap overflow in http2 session.altsvc() - debian/patches/CVE-2026-123828.patch: write the ALTSVC origin and value without a NUL terminator - CVE-2026-123828 * SECURITY UPDATE: HTTP/2 inbound DATA on undrained streams not charged to maxSessionMemory - debian/patches/CVE-2026-123868.patch: charge it and stop reading over the limit - CVE-2026-123868 * SECURITY UPDATE: NULL dereference when a respondWithFile() download is cancelled - debian/patches/CVE-2026-123875.patch: guard against a NULL write request in StreamPipe - CVE-2026-123875 * SECURITY UPDATE: HTTPS empty TLS write re-enters the HTTP parser - debian/patches/CVE-2026-123864.patch: prevent nested parser execution from empty writes - CVE-2026-123864 * SECURITY UPDATE: CA of a certificate-less SNI context ignored for client certificates - debian/patches/CVE-2026-123867.patch: apply the SNI context CA in CertCbDone() - CVE-2026-123867 * SECURITY UPDATE: TLS servername change bypasses client certificate authentication - debian/patches/CVE-2026-123872.patch: pin the SNI across resumption, renegotiation and HelloRetryRequest; disable resumption for mTLS without a session id context - CVE-2026-123872 * SECURITY UPDATE: https.Agent reuses sessions across TLS policies - debian/patches/CVE-2026-123877.patch: encode all TLS policy options in the Agent key - CVE-2026-123877 * SECURITY UPDATE: zlib params() after destroy throws an uncatchable assertion - debian/patches/CVE-2026-123862.patch: handle the params() flush callback after destroy - CVE-2026-123862 * SECURITY UPDATE: recursive fs.watch leaks names of denied paths - debian/patches/CVE-2026-123829.patch: check read permission for each reported filename - CVE-2026-123829