* SECURITY UPDATE: Name constraints bypass when prior CAs have only excluded constraints - debian/patches/CVE-2026-42011.patch: remove the empty-permitted early return in name_constraints_node_list_intersect in lib/x509/name_constraints.c so permitted name constraints of a subsequent CA still propagate when previous CAs only carried excluded constraints; also backport the upstream regression suites to tests/name-constraints-merge.c - CVE-2026-42011 * SECURITY UPDATE: Certificate validation bypass via oversized subject alternative name - debian/patches/CVE-2026-42013.patch: refactor the CN and DN-email fallback logic and disable the fallback when gnutls_x509_crt_get_subject_alt_name reports an oversized SAN (GNUTLS_E_SHORT_MEMORY_BUFFER) in gnutls_x509_crt_check_hostname2 and gnutls_x509_crt_check_email (lib/x509/hostname-verify.c, lib/x509/email-verify.c); also backport the upstream regression tests to tests/hostname-check.c and tests/cert-tests/email (with tests/cert-tests/email-certs/oversized-san.pem) - CVE-2026-42013 * SECURITY UPDATE: CN fallback not precluded by URI or SRV subject alternative names - debian/patches/CVE-2026-42012.patch: add GNUTLS_SAN_URI and GNUTLS_SAN_OTHERNAME_SRV to the PRECLUDES_CN_FALLBACK macro in lib/x509/hostname-verify.c so certificates presenting URI or SRV SANs no longer allow hostname matching against the common name per RFC 6125 6.4.4; backport SRV virtual-SAN awareness (lib/includes/gnutls/gnutls.h.in, lib/x509/common.h, lib/x509/virt-san.c, lib/x509/output.c, lib/x509/x509.c) and the get_alt_name othername virtualization fix so SRV othernames are recognized on 3.6.13; also backport the upstream regression tests to tests/hostname-check.c - CVE-2026-42012