- CVE-2026-123863: http2: release stream headers when a stream is removed from the session - CVE-2026-123865: http2: detect sessions that nghttp2 terminated after a peer GOAWAY - CVE-2026-123866: http2: keep write buffers alive until the socket write finishes - CVE-2026-123874: http2: keep a stream alive while its writes are on the socket - CVE-2026-123828: http2: do not write a NUL terminator past the ALTSVC buffers - CVE-2026-123864: tls: do not read the next record on an empty write inside a TLS cycle - CVE-2026-123862: zlib: handle the params() callback after the stream is destroyed - CVE-2026-123877: https: encode TLS options by type and length in the Agent key - CVE-2026-123868: http2: charge inbound DATA held by paused streams to maxSessionMemory - CVE-2026-123867: tls: apply the CA of an SNI context that has no certificate - CVE-2026-123872: tls: pin the SNI for resumption, renegotiation and HelloRetryRequest