- CVE-2026-43859: use memcpy() instead of strfcpy() in hmac_md5() so a binary MD5 digest of an over-long IMAP CRAM-MD5 secret is not truncated at an embedded NUL - CVE-2026-43860: copy the full MD5_DIGEST_LEN bytes of the hashed IMAP CRAM-MD5 secret in hmac_md5() instead of one byte less - CVE-2026-43861: reject a percent-encoded NUL (%00) as an invalid character in url_pct_decode() - CVE-2026-43862: check that the GSSAPI security-level token is at least 4 bytes before reading it in imap_auth_gss(), and read it as uint32_t - CVE-2026-43863: treat a negative gpgme_data_read() return as an error in data_object_to_stream() instead of looping forever - CVE-2026-43864: check key and key->subkeys for NULL in show_sig_summary()