- CVE-2026-34502: heap buffer overflow in the memcached client, where an unterminated response line lets the length arithmetic in get_server_line() and the stat_read_* helpers underflow - CVE-2026-34501: heap buffer overflow in the redis client, where the unvalidated bulk-string length in grab_bulk_resp() drives allocation and underflows for lengths below two - CVE-2026-32327: unbounded element nesting accepted by the XML parser builds an arbitrarily deep tree that exhausts the stack when walked recursively; the parse now stops at APR_XML_MAX_DEPTH (256)