* SECURITY UPDATE: denial of service through quadratic runtime in the default-attribute lookup performed by storeAtts() - debian/patches/CVE-2026-66046.patch: resolve whether an attribute is declared CDATA through the per-element defaultAttsNames hash table instead of a linear scan of defaultAtts in expat/lib/xmlparse.c - CVE-2026-66046 * SECURITY UPDATE: out-of-bounds read of .attIndex in storeAtts() for parsers created by XML_ExternalEntityParserCreate() - debian/patches/CVE-2026-76641.patch: make dtdCopy() create the defaultAttsNames entries with the size of NAME_AND_DEFAULT_ATTRIBUTE and carry the attribute index over in expat/lib/xmlparse.c - CVE-2026-76641 * SECURITY UPDATE: malformed UTF-16 accepted because a high surrogate was not required to be followed by a low surrogate - debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate in the little2_ and big2_ tokenizers in expat/lib/xmltok.c and expat/lib/xmltok_impl.c - CVE-2026-93990