* SECURITY UPDATE: out-of-bounds read when following a redirect with an empty Location header - debian/patches/php-7.1-CVE-2026-93682.patch: an empty Location header allocates a single byte for the NUL terminator, but the relative-redirect branch of the http stream wrapper tested *(header_info.location+1), so it read past the end of that allocation and could append a path derived from the garbage it found to the redirect target instead of resolving against the host root. Both guards now use header_info.location_len, which our CVE-2025-1861 backport already introduced. This is the net effect of upstream 8196275133 and its follow-up de3436c76e: the first commit used location_len > 0, which made a single-character relative Location resolve against the request path rather than the host root, and the follow-up restored the long-standing behaviour with > 1. Only the final > 1 state is shipped. - CVE-2026-93682 * SECURITY UPDATE: FastCGI listen.allowed_clients compared only the first 96 bits of an IPv6 address - debian/patches/php-7.1-CVE-2026-91768.patch: fcgi_is_allowed() passed a hard-coded length of 12 to the memcmp() that matches a connecting IPv6 client against listen.allowed_clients, so only the leading 96 of the 128 address bits were checked and any client sharing that prefix with an allowed address — including every host in the same /96, and every IPv4-mapped address once the allowed entry is one — was accepted. The comparison now covers the full sizeof(sin6_addr). On 7.1 this code lives in main/fastcgi.c rather than sapi/fpm/fpm/fastcgi.c. - CVE-2026-91768