* SECURITY UPDATE: off-by-one OOB read in mod_proxy_ajp message getters - debian/patches/CVE-2026-33857.patch: tighten length checks (`> msg->len` -> `>= msg->len`) in ajp_msg_get_uint8/16/32 and ajp_msg_peek_uint8/16 in modules/proxy/ajp_msg.c. - CVE-2026-33857 * SECURITY UPDATE: heap over-read in mod_proxy_ajp via missing null-termination check in ajp_msg_get_string() - debian/patches/CVE-2026-34032.patch: switch the buffer overflow check to compare against msg->len and verify the expected null terminator is present before returning the pointer in modules/proxy/ajp_msg.c. - CVE-2026-34032 * SECURITY UPDATE: heap over-read and memory disclosure in mod_proxy_ajp ajp_parse_data() via missing minimum message-length validation - debian/patches/CVE-2026-34059.patch: reject AJP data messages whose `msg->len` is smaller than AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1 before computing expected_len in modules/proxy/ajp_header.c. - CVE-2026-34059 * SECURITY UPDATE: local information disclosure via .htaccess / mod_setenvif / ProxyFCGISetEnvIf, where a non-privileged user with .htaccess write access could read files accessible to the httpd service account - debian/patches/CVE-2026-24072.patch: pass AP_EXPR_FLAG_RESTRICTED when parsing ap_expr expressions from htaccess context in modules/mappers/mod_rewrite.c, modules/metadata/mod_setenvif.c, and modules/proxy/mod_proxy_fcgi.c. - CVE-2026-24072 * SECURITY UPDATE: timing attack against mod_auth_digest allowing bypass of Digest authentication - debian/patches/CVE-2026-33006.patch: validate nonce and digest lengths earlier and replace the strcmp of the nonce hash with the constant-time apr_crypto_equals (apr-util >= 1.6) in modules/aaa/mod_auth_digest.c; bump APU minimum to 1.6 in configure.in. - CVE-2026-33006 * SECURITY UPDATE: NULL pointer dereference in mod_authn_socache crashes the child process in a caching forward proxy setup - debian/patches/CVE-2026-33007.patch: validate the URL before using the cache hash in construct_key() in modules/aaa/mod_authn_socache.c. - CVE-2026-33007 * SECURITY UPDATE: HTTP response splitting via newline/control characters in an outgoing status line forwarded from a compromised backend - debian/patches/CVE-2026-33523.patch: reject status reason strings that contain newlines or control characters in modules/http/http_filters.c. - CVE-2026-33523