* SECURITY UPDATE: out-of-bounds write in mod_charset_lite - debian/patches/CVE-2026-56153.patch: in finish_partial_char() in modules/filters/mod_charset_lite.c, stop accumulating a split multibyte character once ctx->saved reaches the size of ctx->buf so the next byte can no longer be written past the 8-byte buffer. Backported from httpd commit 6654234dcb395e07fd62255670356f84ec733195 (SVN r1938658). - CVE-2026-56153 * SECURITY UPDATE: use-after-free in mod_rewrite lookahead variables - debian/patches/CVE-2026-56154.patch: in lookup_variable() in modules/mappers/mod_rewrite.c, copy ctx->vary_this into the main request pool after an LA-U/LA-F lookahead sub-request so the Vary header name no longer points into the destroyed sub-request pool. Backported from httpd commit 6e4d1e614597109909dda495d235b6a1331d7beb (SVN r1938660). - CVE-2026-56154 * SECURITY UPDATE: out-of-bounds write in mod_proxy_html - debian/patches/CVE-2026-56449.patch: in pcomment() in modules/filters/mod_proxy_html.c, do not call dump_content() after writing an HTML comment so crafted response bodies can no longer trigger a write outside the output buffer. Backported from httpd commit c721d4e1cf5c142149509490015cef1a75715595 (SVN r1935931). - CVE-2026-56449 * SECURITY UPDATE: stack-based buffer overflow in mod_vhost_alias - debian/patches/CVE-2026-63292.patch: in vhost_alias_checkspace() and vhost_alias_interpolate() in modules/mappers/mod_vhost_alias.c, reject a single expanded segment (e.g. a Host header) of HUGE_STRING_LEN bytes or more with 414 instead of writing past the stack buffer. Backported from httpd commit 7ed3f91688b7a1e1ac48486fd2e5eeb2932e879f (SVN r1938675). - CVE-2026-63292 * SECURITY UPDATE: use-after-free in mod_http2 via session->bbtmp - debian/patches/CVE-2026-57941.patch: in modules/http2/h2_session.c, h2_c1_io.c and h2_mplx.c, use a per-call brigade instead of the shared session->bbtmp in on_send_data_cb() and ev_stream_closed(), remove buckets before feeding them, guard stream cleanup against re-entrancy with in_stream_cleanup/mplx_cleanup_done, and allocate the input/output iqueues from a separate pool. Backported from httpd commit d072ed8f06d66a30072227d61a2fc04ad9ae5c99 (SVN r1938665). - CVE-2026-57941