- CVE-2026-123863: http2: release stream headers when a stream is removed - CVE-2026-123866: http2: retain write buffers until socket writes finish - CVE-2026-123874: http2: retain streams during pending socket writes - CVE-2026-123875: http2: guard against null write request on cancelled stream - CVE-2026-123864: tls,http: prevent nested parser execution from empty writes - CVE-2026-123862: zlib: handle params() callback after destroy - CVE-2026-123828: http2: do not NUL-terminate ALTSVC origin/value buffers - CVE-2026-123868: http2: charge inbound DATA retained by paused streams to maxSessionMemory - CVE-2026-123867: tls: apply the CA of SNI contexts without a certificate - CVE-2026-123872: tls: pin the first ClientHello SNI and bind sessions to it - CVE-2026-123877: https: isolate Agent TLS policy keys