* SECURITY UPDATE: path traversal in Archive::Tar via unvalidated symlink and hardlink targets in the tar header - debian/patches/CVE-2026-42496.patch: reject absolute and escaping '..' link targets in Archive::Tar::_make_special_file() unless $Archive::Tar::INSECURE_EXTRACT_MODE is set, resolving the target through _symlinks_resolver() so links that stay inside the extraction directory keep working - CVE-2026-42496 * SECURITY UPDATE: memory exhaustion in Archive::Tar via an attacker-controlled entry size field in the tar header - debian/patches/CVE-2026-9538.patch: cap the per-entry declared size in Archive::Tar::_read_tar() with $Archive::Tar::MAX_FILE_SIZE (default 1 GiB), refusing the entry before the read buffer is allocated - CVE-2026-9538 * SECURITY UPDATE: arbitrary code execution in File::GlobMapper via an attacker-controlled output glob - debian/patches/CVE-2026-48962.patch: replace the eval STRING in File::GlobMapper::_getFiles() with literal substitution of the internal markers set up by _parseOutputGlob() in cpan/IO-Compress/lib/File/GlobMapper.pm - CVE-2026-48962 * SECURITY UPDATE: integer overflow when computing a pack/unpack template structure size - debian/patches/CVE-2026-57432.patch: croak in S_measure_struct() in pp_pack.c when the computed structure size would overflow SSize_t, and document the new diagnostic in pod/perldiag.pod - CVE-2026-57432 * SECURITY UPDATE: signed integer overflow when deserializing a crafted Storable SX_HOOK record - debian/patches/CVE-2026-57433.patch: reject a hook data item count of I32_MAX in retrieve_hook_common() in dist/Storable/Storable.xs before it is incremented and passed to av_extend() - CVE-2026-57433 * SECURITY UPDATE: HTTP::Tiny did not verify TLS certificates by default - debian/patches/CVE-2023-31486.patch: default verify_SSL to 1 in cpan/HTTP-Tiny/lib/HTTP/Tiny.pm and add the PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT escape hatch, matching HTTP::Tiny 0.083 - CVE-2023-31486