* SECURITY UPDATE: NULL pointer dereference in CMS EnvelopedData processing when a KeyAgreeRecipientInfo message omits the optional parameters field of KeyEncryptionAlgorithmIdentifier. Both dh_cms_set_shared_info() and ecdh_cms_set_shared_info() dereference alg->parameter without a NULL check, allowing a remote attacker to crash applications that process untrusted CMS data (e.g. S/MIME decryption), causing Denial of Service before any authentication or cryptographic operations occur. - debian/patches/CVE-2026-28389.patch: use X509_ALGOR_get0() to safely extract algorithm OID and parameter type/value in dh_cms_set_shared_info() in crypto/dh/dh_ameth.c and ecdh_cms_set_shared_info() in crypto/ec/ec_ameth.c instead of dereferencing alg->parameter directly - CVE-2026-28389