* SECURITY UPDATE: stale custom cookie host causes cookie leak - debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c. - CVE-2026-6276 * SECURITY UPDATE: wrong STARTTLS connection reuse - debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c. - CVE-2026-8286 * SECURITY UPDATE: env-set cross-proxy Digest auth state leak - debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h. - CVE-2026-8927 * SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS session cache - debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c. - CVE-2026-8932 * SECURITY UPDATE: HTTP/2 push headers memory leak - debian/patches/CVE-2024-2398.patch: free the whole set of push headers on the array-growth failure path in lib/http2.c. - CVE-2024-2398