- CVE-2026-8927: detect proxy changes read from environment so Digest proxy auth state is flushed instead of leaking the Proxy-Authorization header for one proxy into a request sent through another - CVE-2026-8286: require an SSL configuration match before reusing a pooled connection for a clear-text transfer that may upgrade to TLS via STARTTLS - CVE-2026-8932: include the client certificate key, key type, key password, key blob and certificate type in SSL configuration matching so a connection or cached TLS session established with different mTLS credentials is not reused