* SECURITY UPDATE: name-constraints bypass with excluded-only parent CA - debian/patches/CVE-2026-42011.patch: take permitted name constraints into account when a prior CA in the chain carried only excluded constraints, so a constrained sub-CA can no longer issue certificates outside its permitted scope, in lib/x509/name_constraints.c. - CVE-2026-42011 * SECURITY UPDATE: CN fallback not precluded by URI SAN - debian/patches/CVE-2026-42012.patch: treat a URI subject alternative name as precluding the fallback to Common Name hostname matching, per RFC 6125 6.4.4, in lib/x509/hostname-verify.c. - CVE-2026-42012 * SECURITY UPDATE: CN/DN fallback not precluded by oversized SAN - debian/patches/CVE-2026-42013.patch: keep the CN (hostname) and DN-email fallbacks disabled when a subject alternative name is oversized instead of silently ignoring it, per RFC 6125 6.4.4, in lib/x509/hostname-verify.c and lib/x509/email-verify.c. - CVE-2026-42013 * SECURITY UPDATE: PKCS#12 bag out-of-bounds write - debian/patches/CVE-2026-42015.patch: fix an off-by-one in the PKCS#12 bag element bounds check that allowed writing past the 32-element array, in lib/x509/pkcs12_bag.c. - CVE-2026-42015