* SECURITY UPDATE: heap buffer over-read parsing large DER ASN.1 elements - debian/patches/openssl-1.1.1-cve-2026-34180.patch: keep the ASN.1 content length as a long in asn1_ex_c2i() and reject elements whose length does not fit in an int, so a primitive element longer than 2GB can no longer be truncated into a negative length and make ASN1_STRING_set() read past the end of the input buffer. - CVE-2026-34180 * SECURITY UPDATE: NULL pointer dereference in password-based CMS decryption - debian/patches/openssl-1.1.1-cve-2026-42766.patch: check that the OPTIONAL PasswordRecipientInfo.keyDerivationAlgorithm field is present before dereferencing it in cms_RecipientInfo_pwri_crypt(), so a crafted password-encrypted CMS message can no longer crash the application. - CVE-2026-42766