- CVE-2026-59847: integrity downgrade of AES-GCM ciphers in the OpenSSL backend, where a wrong EVP_DecryptFinal() return-code check let a forged authentication tag pass and silently reduced AES-GCM to AES-CTR - CVE-2026-59850: use-after-free via channel data callbacks invoked on remotely-closed channels, where already-freed channel data could still be handed to application callbacks