* SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header parsing with an attacker-controlled proxy - debian/patches/CVE-2026-94054.patch: set ret to the length of the heap copy of the PROXY v1 line instead of adding the swallow_until_crlf() count, so the memchr() for the CR stays inside the copy - CVE-2026-94054 * SECURITY UPDATE: uninitialised stack data read on a short Proxy-Protocol v2 header from an attacker-controlled proxy - debian/patches/CVE-2026-94056.patch: repeat the read of the v2 length fields until all 16 header octets have arrived, and abort on EOF or error instead of using uninitialised length data - CVE-2026-94056