- CVE-2026-15172: do not precompute the FMP/NOTIFY handle list length to avoid an integer overflow - CVE-2026-15174: cap E-DCH DDI entries at MAX_EDCH_DDIS in the Catapult DCT2000 dissector - CVE-2026-5407: check for offset overflow in SMB2 EA info and notify data dissection - CVE-2026-6534: skip USB HID items with a report size of zero to prevent an infinite loop - CVE-2026-6533: sanity check the LZ77 uncompression size - CVE-2026-6522: check for offset overflow on unknown RPKI-RTR PDU types to prevent an infinite loop - CVE-2026-5404: fix a stack buffer overflow when writing K12 source descriptor records - CVE-2026-6529: report the proper iLBC decoded length for multi-frame payloads - CVE-2026-6530: require equal-size fragments for DCP ETSI Reed-Solomon reassembly - CVE-2026-6870: stop using a global tree pointer in the GSM RP dissector - CVE-2026-6869: bound WebSocket permessage-deflate decompression buffer growth - CVE-2026-6521: prevent infinite loops in OpenFlow v5 action and table description dissection - CVE-2026-6526: check the strstr() result when resolving HTTP Location targets to avoid a crash - CVE-2026-6532: fix a heap buffer overflow in the Kismet dissector - CVE-2026-15163: advance dissection offsets in the MIH, MPEG DSM-CC, eDonkey and MEGACO dissectors to prevent infinite loops