* SECURITY UPDATE: uncontrolled recursion in SGML catalog parsing - debian/patches/CVE-2025-8732.patch: thread a depth counter through xmlParseSGMLCatalog() and xmlExpandCatalog() in catalog.c and bail out past MAX_CATAL_DEPTH, and register expanded catalog filenames in the SGML hash table before recursing so a repeated CATALOG directive is only followed once, to prevent stack exhaustion and exponential re-parsing on self-referencing SGML CATALOG entries. Add test files result/catalogs/recursive, test/catalogs/recursive.script and test/catalogs/recursive.sgml - CVE-2025-8732 * SECURITY UPDATE: uncontrolled recursion in the RelaxNG parser via nested schema includes - debian/patches/CVE-2026-0989.patch: add an include depth limit to the RelaxNG parser context in relaxng.c, defaulting to 1000 and overridable via the RNG_INCLUDE_LIMIT environment variable or the new xmlRelaxParserSetIncLImit() entry point in include/libxml/relaxng.h, and make xmlRelaxNGIncludePush() failures propagate. Add coverage in runtest.c and test/relaxng/include/include-limit*.rng - debian/libxml2.symbols: add the new xmlRelaxParserSetIncLImit symbol - CVE-2026-0989 * SECURITY UPDATE: uncontrolled recursion in XML catalog URI resolution - debian/patches/CVE-2026-0990.patch: add a MAX_CATAL_DEPTH guard to xmlCatalogListXMLResolveURI() in catalog.c and stop clobbering the catalog entry used for depth bookkeeping while walking the entry list, to prevent stack exhaustion on a self-referencing delegateURI entry - CVE-2026-0990 * SECURITY UPDATE: uncontrolled resource consumption via repeated nextCatalog entries - debian/patches/CVE-2026-0992.patch: ignore duplicate nextCatalog entries in xmlParseXMLCatalogNode() in catalog.c, to prevent redundant exponential traversal of catalog chains. Guard the new loop against a NULL entry so a nextCatalog element without a 'catalog' attribute is still skipped with an error instead of crashing - CVE-2026-0992