* SECURITY UPDATE: HTTP header injection via obsolete line folding - debian/patches/CVE-2026-63385.patch: reject any header value that contains a CR or LF character in evhttp_header_is_valid_value() in http.c, test/regress_http.c; backported partially: a %00 escape decoded to a NUL byte by evhttp_decode_uri_internal() is still accepted, as in upstream - CVE-2026-63385 * SECURITY UPDATE: HTTP request smuggling via Transfer-Encoding handling and bare-LF chunk framing - debian/patches/CVE-2026-63382.patch: require CRLF to terminate chunk size lines, reject requests with both Transfer-Encoding and Content-Length or with duplicate Content-Length headers, and parse every Transfer-Encoding header so that only a list ending in "chunked" selects chunked framing in http.c, http-internal.h, test/regress_http.c - CVE-2026-63382