* SECURITY UPDATE: Denial of service via quadratic complexity in storeAtts(), which scanned elementType->defaultAtts linearly to determine the CDATA status of every non-normalized attribute (libexpat through 2.8.3) - debian/patches/CVE-2026-66046.patch: store the index of the first default attribute declaration in the per-element defaultAttsNames hash table and use a hash lookup instead of the linear scan in expat/lib/xmlparse.c; includes upstream's follow-up for dtdCopy() so that external entity parsers do not read past the hash table entries, and carries upstream's regression test into expat/tests/runtests.c - CVE-2026-66046 * SECURITY UPDATE: XML injection via malformed UTF-16 input: a high surrogate not followed by a low surrogate is accepted and consumes the following code unit, hiding markup characters from the parser (libexpat through 2.8.4) - debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate by defining IS_INVALID_CHAR (and isInvalid4 for XML_MIN_SIZE) for the little2_/big2_ encodings in expat/lib/xmltok.c and dropping the permissive fallback from expat/lib/xmltok_impl.c; also carries upstream's regression test into expat/tests/runtests.c - CVE-2026-93990