- CVE-2026-8927: flush the proxy Digest authentication state when the proxy read from an environment variable differs from the one that state was established for, so a Proxy-Authorization header computed for one proxy is not sent to a different proxy on a reused handle - CVE-2026-8932: compare the client certificate type and the private key, its type, password and blob when matching a connection for reuse and when matching a cached TLS session, so a transfer cannot silently inherit another handle's authenticated client identity