* CVE-2026-50659: detect CR/LF line endings across write buffers in System.Net.Mime.EightBitStream — an SMTP DATA dot-stuffing / header-injection spoofing gap when a CRLF is split over two writes. - debian/patches/CVE-2026-50659.patch: backport of upstream dotnet/runtime commit 5c8ca0d6 ("Fix CRLF encoding in EightBitStream", 2026-04-09, PR #60066). Tracks a _lastWriteEndedWithCr flag across writes and factors the per-byte scan into a new EncodeLines() helper so a boundary-split CRLF is dot-stuffed correctly. The flush-on-close part follows main's version of the fix (6e0eb8307f): Close() override plus base.DisposeAsync(), because on .NET 7 DelegatedStream.Close() never reaches Dispose(bool), which would leave the 8.0 variant's override dead. The two regression theories from 6e0eb8307f are ported to EightBitStreamTest.cs. Additive; no public surface change. net6 6.0.36 backport is byte-identical to the upstream added code. - CVE-2026-50659 * CVE-2026-62899: reject Content-Length values above long.MaxValue in the managed HttpListener instead of treating them as 0 — HTTP request smuggling (CWE-444). - debian/patches/CVE-2026-62899.patch: backport of upstream dotnet/runtime commit e2844c3b (PR #62798, release/8.0, 2026-07-13). HttpListenerRequest.Managed.cs AddHeader replaces the permissive ulong parse with strict long.TryParse(NumberStyles.None, InvariantCulture) and rejects the request on failure. Upstream regression tests ported. Additive; no public surface change. Cross-checked against the net6 6.0.36 backport. - CVE-2026-62899 * CVE-2026-62900: SourceLink leaked credentials embedded in git remote URLs (e.g. access tokens in https://user:token@host/...) into the RepositoryUrl / SourceLink metadata of built assemblies and NuGet packages (information disclosure). Affects the sourcelink 1.2.0 sources built into the dotnet7 SDK. - debian/patches/CVE-2026-62900.patch: backport of upstream dotnet/sourcelink commit cc896b0983ea ("Strip user name and password from repository URLs", #1761, 2026-08-12). GitOperations.NormalizeUrl now strips user info from every normalized URL (password always removed, SSH user name replaced with the "git" placeholder); the legacy Azure DevOps v1/v2 hosted SSH URL format (which used the SSH user name as the account name) is retired via a new isUnsupportedFormat flag and a NotSupportedException with the new RemoteUrlFormatNoLongerSupported resource (mirrored into all 13 xlf files). Core code paths byte-identical to upstream; the replaced public TryParseHostedSsh signature is kept as a forwarding overload per patch-engine rules; unit tests ported, integration-test changes N/A (project not built in source-build). 20 files. - CVE-2026-62900