- CVE-2026-63074: roll cached CMP extraCerts back off ctx->untrusted on both message-rejection paths, so a client that repeatedly sends rejected messages can no longer grow a long-lived OSSL_CMP_CTX without bound - CVE-2026-63076: require the CMP protectionAlg parameter to be a V_ASN1_SEQUENCE before it is used as a PBMParameter, so a crafted parameter of another ASN.1 type is no longer dereferenced as a bogus pointer - CVE-2026-14457: skip the signature_algorithms_cert restriction when RFC 7250 raw public keys are negotiated and reject a key-only slot when they are not, so a peer soliciting raw public keys against a key-only configuration can no longer trigger a NULL pointer dereference in check_cert_usable() - CVE-2026-63075: stop recording ACK-only QUIC packets in the TX history while still advancing the history's highest sent packet number, so a peer that withholds acknowledgements can no longer drive unbounded memory growth