* SECURITY UPDATE: detect streams abandoned by nghttp2 - debian/patches/CVE-2026-123865.patch: detect streams abandoned by nghttp2 - CVE-2026-123865 * SECURITY UPDATE: avoid overflowing ALTSVC buffers - debian/patches/CVE-2026-123828.patch: avoid overflowing ALTSVC buffers - CVE-2026-123828 * SECURITY UPDATE: handle zlib params callback after destroy - debian/patches/CVE-2026-123862.patch: handle zlib params callback after destroy - CVE-2026-123862 * SECURITY UPDATE: release headers when a stream is removed - debian/patches/CVE-2026-123863.patch: release headers when a stream is removed - CVE-2026-123863 * SECURITY UPDATE: prevent nested parser execution from empty writes - debian/patches/CVE-2026-123864.patch: prevent nested parser execution from empty writes - CVE-2026-123864 * SECURITY UPDATE: apply the CA of SNI contexts without a certificate - debian/patches/CVE-2026-123867.patch: apply the CA of SNI contexts without a certificate - CVE-2026-123867 * SECURITY UPDATE: retain buffers until socket writes finish - debian/patches/CVE-2026-123866.patch: retain buffers until socket writes finish - CVE-2026-123866 * SECURITY UPDATE: charge inbound DATA retained by streams to maxSessionMemory - debian/patches/CVE-2026-123868.patch: charge inbound DATA retained by streams to maxSessionMemory - CVE-2026-123868 * SECURITY UPDATE: isolate Agent TLS policy keys - debian/patches/CVE-2026-123877.patch: isolate Agent TLS policy keys - CVE-2026-123877 * SECURITY UPDATE: do not allow resumption, renegotiation or HRR to change SNI - debian/patches/CVE-2026-123872.patch: do not allow resumption, renegotiation or HRR to change SNI - CVE-2026-123872 * SECURITY UPDATE: retain streams during pending writes - debian/patches/CVE-2026-123874.patch: retain streams during pending writes - CVE-2026-123874