* SECURITY UPDATE: unbounded hash-chain walk in the delta-transfer matcher - debian/patches/CVE-2026-70453.patch: bound the hash_search() chain walk in match.c so a crafted checksum set cannot drive quadratic CPU use - CVE-2026-70453 * SECURITY UPDATE: peer-supplied I/O timeout accepted as non-positive - debian/patches/CVE-2026-70462.patch: reject a non-positive MSG_IO_TIMEOUT from the peer in io.c - CVE-2026-70462 * SECURITY UPDATE: unbounded daemon pre-transfer handshake - debian/patches/CVE-2026-70464.patch: bound the pre-transfer handshake with a timeout in clientserver.c and io.c - CVE-2026-70464 * SECURITY UPDATE: malicious-peer protocol input and checksum-slot lifetime - debian/patches/CVE-2026-70458-1.patch: daemon robustness against malicious-peer protocol input - debian/patches/CVE-2026-70458-2.patch: guard the F_SUM checksum-slot lifetime in hlink.c and main.c - debian/patches/CVE-2026-70458-3-copy-devices.patch: extend the same guard to the copy-devices path - CVE-2026-70458 * SECURITY UPDATE: daemon authentication, access and argument hardening - debian/patches/CVE-2026-53790-1.patch: harden daemon authentication, access, socket and argument handling - debian/patches/CVE-2026-53790-2-shell-chars.patch: confine operator- and peer-supplied paths to the served tree and reject shell metacharacters - debian/patches/CVE-2026-53790-3-uninit.patch: fix a safe_arg() uninitialized-byte leak in options.c - CVE-2026-53790 * SECURITY UPDATE: inner-module escape for a daemon module using /./ - debian/patches/CVE-2026-53793-1-basis-paths.patch: stat alternate-basis candidates through the confined resolver in generator.c - debian/patches/CVE-2026-53793-2-inner-module.patch: widen the use_secure_symlinks and change_dir() gates from "am_daemon && !am_chrooted" to "am_daemon && (!am_chrooted || module_dirlen)" so an inner module root is the trust boundary, not the kernel chroot - CVE-2026-53793