* SECURITY UPDATE: unchecked 32-bit attribute count from a publickey subsystem response is multiplied by the attribute size without a bounds check, so on 32-bit builds the product wraps to an undersized allocation that the parsing loop then overflows - debian/patches/CVE-2026-58050.patch: cap the attribute count at 1024 and fail with LIBSSH2_ERROR_OUT_OF_BOUNDARY before the allocation, and zero-initialise the freshly reallocated list entry so the new error path cannot free uninitialised attrs/packet pointers in libssh2_publickey_list_free(), in libssh2_publickey_list_fetch() in src/publickey.c - CVE-2026-58050 * SECURITY UPDATE: double free in sftp_open() lets a malicious SSH server corrupt the heap of an authenticated client opening an SFTP session - debian/patches/CVE-2026-66032.patch: set data to NULL after freeing the SSH_FXP_STATUS response buffer on the FX_OK path, so the if(badness) arm cannot free the same pointer a second time when the follow-up sftp_packet_require() for SSH_FXP_HANDLE fails, in sftp_open() in src/sftp.c - CVE-2026-66032