* SECURITY UPDATE: use-after-free in mod_ldap per-directory client certificate configuration - debian/patches/CVE-2026-29167.patch: deep-copy the per-directory client_certs array (each cert path and password) into the connection pool in uldap_connection_find() so the cached connection no longer retains pointers into the short-lived per-directory config pool in modules/ldap/util_ldap.c. - CVE-2026-29167 * SECURITY UPDATE: buffer overflow in mod_proxy_html with an untrusted backend response - debian/patches/CVE-2026-34355.patch: replace the hand-managed preserve()/pappend() output buffer with the bounds-checked ap_varbuf API (ap_varbuf_grow, ap_varbuf_strmemcat, ap_varbuf_regsub) for the CDATA, element and event URL rewrites so an oversized substitution can no longer overflow the buffer in modules/filters/mod_proxy_html.c. - CVE-2026-34355 * SECURITY UPDATE: heap buffer overflow in mod_proxy ProxyPassReverseCookie handling with a malicious backend response - debian/patches/CVE-2026-34356.patch: reset newpath/pdiff and newdomain/ddiff for each path= and domain= cookie attribute in ap_proxy_cookie_reverse_map() so a duplicate attribute can no longer reuse a stale length offset and overflow the rewritten cookie buffer in modules/proxy/proxy_util.c. - CVE-2026-34356