* SECURITY UPDATE: configparser key/value injection via CR/CRLF - debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line endings when writing multi-line values in RawConfigParser so a carriage return cannot inject additional keys into the output. - CVE-2026-0864 * SECURITY UPDATE: http.client proxy CONNECT tunnel header injection - debian/patches/CVE-2026-1502.patch: reject CR/LF in the proxy tunnel host and in set_tunnel() custom headers before writing the CONNECT request. - CVE-2026-1502 * SECURITY UPDATE: unicodedata.normalize() quadratic-time DoS - debian/patches/CVE-2026-3276.patch: replace the O(n^2) canonical ordering insertion sort with a counting sort for long combining runs to prevent CPU-exhaustion on crafted input. - CVE-2026-3276 * SECURITY UPDATE: http.cookies js_output() script injection (XSS) - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value embedded in the inline sequence cannot break out. - CVE-2026-6019 * SECURITY UPDATE: tarfile data filter path traversal - debian/patches/CVE-2026-7774.patch: validate the written link target against the extraction root in the data/tar filter. - CVE-2026-7774 * SECURITY UPDATE: ftplib.ftpcp() data-connection SSRF - debian/patches/CVE-2026-8328.patch: apply the CVE-2021-4189 PASV peer-address check to ftpcp() so a malicious source server cannot redirect the target's data connection. - CVE-2026-8328 * SECURITY UPDATE: tarfile hardlink-extraction symlink escape - debian/patches/CVE-2026-11940.patch: pre-validate the symlink at the hardlink's own name in the extraction-filter fallback to prevent a path-traversal escape (incomplete fix of CVE-2025-4330). - CVE-2026-11940 * SECURITY UPDATE: tarfile stream-seek infinite-loop DoS - debian/patches/CVE-2026-11972.patch: break out of _Stream.seek() on EOF so a truncated stream archive cannot cause an unbounded loop. - CVE-2026-11972