- CVE-2026-33818: enforce a maximum recursion depth in encoding/asn1 Unmarshal to prevent stack exhaustion when parsing deeply-nested recursive structures - CVE-2026-56853: apply ReadHeaderTimeout to the server's unencrypted HTTP/2 client preface check, and clear the connection timeouts again once the connection is handed off to the http2 package - CVE-2026-56858: fix JavaScript regexp context tracking in html/template so that pathological input can no longer close an unescaped '/' early and inject attacker-controlled content - CVE-2026-56859: add a recursion depth guard during decode in encoding/xml so that DecodeElement no longer resets the depth counter, preventing stack exhaustion - CVE-2026-56860: avoid quadratic complexity in net/url resolvePath by resolving '..' segments with index-based backtracking on a byte buffer - CVE-2026-56862: do not count handshake messages as state-advancing after the handshake has completed in crypto/tls, bounding the key derivation work a client can force with repeated KeyUpdate messages