* SECURITY UPDATE: HTTP/2 requests without an authority bypassed strict SNI validation - the fix for CVE-2026-32990 required an authority only for CONNECT requests, so a request using any other method could omit it and evade the host check - debian/patches/CVE-2026-65637.patch: treat a missing serverName as a missing header for all non-CONNECT HTTP/2 requests in receivedEndOfHeaders() - CVE-2026-65637 * SECURITY UPDATE: Denial of service via an allocation leak in the HTTP/2 backlog - resetting a stream that was waiting on the connection window left its reservation counted in the backlog and its allocation unreturned, so repeated resets exhausted the connection window and stalled the connection - debian/patches/CVE-2026-68763.patch: remove a replaced stream from the backlog and return its unused allocation to the connection window, decrement backLogSize when allocating, and skip streams that can no longer write - CVE-2026-68763