* SECURITY UPDATE: quadratic runtime in the default-attribute lookup of storeAtts(), and an out-of-bounds read in the same lookup for parsers created by XML_ExternalEntityParserCreate() - debian/patches/CVE-2026-66046.patch: in lib/xmlparse.c, replace the linear scan over ELEMENT_TYPE.defaultAtts in storeAtts() with a lookup in the already-present defaultAttForName hash table, and make dtdCopy() create NAME_AND_DEFAULT_ATTRIBUTE-sized entries so storeAtts() no longer reads member .attIndex past the end of an entry. - CVE-2026-66046 * SECURITY UPDATE: a UTF-16 high surrogate not followed by a low surrogate was accepted, letting the high surrogate swallow the following code unit and hide it from the tokenizer - debian/patches/CVE-2026-93990.patch: in lib/xmltok.c, add LITTLE2_IS_INVALID_CHAR() / BIG2_IS_INVALID_CHAR() and wire them into IS_INVALID_CHAR() for the little2_/big2_ tokenizers, so INVALID_LEAD_CASE() in lib/xmltok_impl.c rejects a 4-byte UTF-16 character whose second code unit is not U+DC00..U+DFFF; drop the now unreachable IS_INVALID_CHAR() no-op fallback in lib/xmltok_impl.c. - CVE-2026-93990