* SECURITY UPDATE: out-of-bounds read in decode_tag_internal() - debian/patches/CVE-2026-63383.patch: bound the tag decoding loop by the pulled-up length instead of the full buffer length in event_tagging.c - CVE-2026-63383 * SECURITY UPDATE: integer overflow in evtag_unmarshal_header() - debian/patches/CVE-2026-63384.patch: reject payload lengths above INT_MAX in event_tagging.c, include/event2/tag.h - CVE-2026-63384 * SECURITY UPDATE: heap out-of-bounds write in bufferevent_socket_set_conn_address_() via an AF_UNIX peer address - debian/patches/CVE-2026-63388.patch: check the address length regardless of NDEBUG, fail the connection on an over-long address and make conn_address large enough for AF_UNIX in bufferevent_sock.c, bufferevent-internal.h, http.c - CVE-2026-63388 * SECURITY UPDATE: off-by-one stack buffer overflow in dnsname_to_labels() - debian/patches/CVE-2026-63387.patch: refuse to write the terminating label byte past the end of the buffer in evdns.c - CVE-2026-63387