* SECURITY UPDATE: use-after-free in mod_rewrite lookahead variables - debian/patches/CVE-2026-56154.patch: copy the Vary value gathered during a LA-U/LA-F lookahead into the main request pool before the sub-request is destroyed in modules/mappers/mod_rewrite.c. - CVE-2026-56154 * SECURITY UPDATE: buffer overflow in mod_vhost_alias interpolation - debian/patches/CVE-2026-63292.patch: reject a VirtualDocumentRoot expansion segment that does not fit the buffer in modules/mappers/mod_vhost_alias.c. - CVE-2026-63292 * SECURITY UPDATE: crash in mod_xml2enc on incomplete input - debian/patches/CVE-2026-63686.patch: handle APR_INCOMPLETE from the converter and pass the rest raw after a conversion failure instead of reusing a NULL converter in modules/filters/mod_xml2enc.c. - CVE-2026-63686 * SECURITY UPDATE: digest replay and use-after-free in mod_auth_digest - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: enforce one-time nonce and nonce-count handling, and only use shared client entries under the client lock, in modules/aaa/mod_auth_digest.c. - CVE-2026-73636 - CVE-2026-73637