Fedora Security Advisories

FEDORA-EPEL-2026-7e7a60affc Packages in this update:

• rust-cargo-semver-checks-0.51.0-6.el10_4
• rust-trustfall-rustdoc-adapter57-57.1.3-2.el10_4
• rust-trustfall-rustdoc-adapter60-60.0.3-2.el10_4
• rust-trustfall-rustdoc-adapter-61.0.3-1.el10_4

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349, with faster-hex 0.10.1 for RUSTSEC-2026-0306, and with updated dependencies for the eMudhra intermediate CA compromise. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

FEDORA-2026-d5f8446449 Packages in this update:

• php-8.4.27-2.fc43

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9354b8a1e Packages in this update:

• php-8.5.12-1.fc45

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9eba4bbc3 Packages in this update:

• php-8.5.12-1.fc44

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-EPEL-2026-1d3c013156 Packages in this update:

• ntpsec-1.2.6-1.el10_3

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-18321 CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-EPEL-2026-077c9d1631 Packages in this update:

• ntpsec-1.2.6-1.el9

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-18321 CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-2026-ed3c0a9bce Packages in this update:

• libmspack-0.11-0.1.alpha.fc46

Update description:

Automatic update for libmspack-0.11-0.1.alpha.fc46.

Changelog * Wed Oct 21 2026 Dan Horák <dan[at]danny.cz> - 0.11-0.1.alpha - updated to 0.11alpha - fix CVE-2026-110602 (rhbz#2558186) - add %check section

FEDORA-2026-6b7650cc3c Packages in this update:

• rust-cargo-semver-checks-0.51.0-6.fc43
• rust-trustfall-rustdoc-adapter57-57.1.3-2.fc43
• rust-trustfall-rustdoc-adapter60-60.0.3-2.fc43
• rust-trustfall-rustdoc-adapter-61.0.3-1.fc43

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349, with faster-hex 0.10.1 for RUSTSEC-2026-0306, and with updated dependencies for the eMudhra intermediate CA compromise. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

FEDORA-2026-b86561a89a Packages in this update:

• clevis-24-1.fc45

Update description:

Add new sources (release 24)

FEDORA-2026-9379466325 Packages in this update:

• clevis-24-1.fc44

Update description:

Add new sources (release 24)

FEDORA-2026-7fb98d1c29 Packages in this update:

• ntpsec-1.2.6-1.fc45

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-2026-cf1a6e2b9d Packages in this update:

• ntpsec-1.2.6-1.fc43

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-2026-0c9e216697 Packages in this update:

• ntpsec-1.2.6-1.fc44

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-2026-2a746a0a40 Packages in this update:

• knot-3.5.10-1.fc44

Update description:

New upstream release containing various security fixes.

See release notes for more details.

FEDORA-2026-b12734706a Packages in this update:

• knot-3.6.2-1.fc45

Update description:

New upstream release containing various security fixes.

See release notes for more details.

FEDORA-2026-1b60a5536e Packages in this update:

• libXi-1.8.4-1.fc45

Update description:

libXi 1.8.4, fixes CVE-2026-109090, CVE-2026-109089, CVE-2026-94282, CVE-2026-94281, CVE-2026-93545, CVE-2026-93544, CVE-2026-93543, CVE-2026-93542, CVE-2026-93541

FEDORA-2026-56b692bd7b Packages in this update:

• trafficserver-10.2.1-1.fc44

Update description:

Changes with Apache Traffic Server 10.2.1 #13553 - origin_server_auth: Improve log messages #13567 - Metrics: Revert added locking and annotations #13505 - Add hidden metrics and MAX/MIN/incremental derived metric aggregation #13538 - Fix records_yaml startup lookup race #13510 - doc: rate_limit uses max_age, not max-age #13238 - prefetch: move cache key acquisition to CACHE_LOOKUP_COMPLETE #13580 - compress: add Vary to cached client responses #13506 - Per upstream server connection metrics via hidden and derived metrics #13577 - Fix silently dropped Streams.all autest assertions #13110 - Add _reload directive support for config reload framework. #13589 - Skip rate_limit AuTests when plugin not built #13593 - Fix Clang 21 analyzer findings #13576 - Fix client certificate context updates #13578 - Remove dead JSONRPC server_shutdown handler #13227 - Fix data race in SSLCertContext copy & assignment #13642 - Proxy Verifier v3.2.0 #13558 - dns: fix remaining-space tracking when copying address records #13570 - Argparser variable arg option parsing fix/improvement. #13583 - Metrics: close the id lookup race and bounds gaps left by the lock revert #13652 - Restore regex_remap's default PCRE2 match limit #13646 - header_rewrite: build the matcher for %{LAST-CAPTURE} conditions #13514 - Share HTTP accept properties #13645 - Cleanup LogField Registration #13063 - Add changelog generation tool for GitHub milestones #13574 - Fix TransformVConnection leak in abort_tunnel() #13450 - h2origin autest: honor the 30s squid.log wait budget #13672 - header_rewrite: guard the i == 0 case in HRWSimpleTokenizer #13673 - Fix build errors with LLVM 23 #13616 - Allow a metric to be unlisted #13697 - Fix strncasecmp checks that accepted a prefix as equal #13355 - Add --version CLI flag to hrw4u #13666 - Retract per server metrics when the mode changes #13700 - Fix the 9.2 compatibility cache key for paths that carry ";params" #13696 - hrw4u: admit SESSION_VARS as a denyable section #13611 - Make the 9.2 compatibility cache key usable end to end #13571 - Use __atomic builtins as the freelist 128-bit CAS fallback #13655 - QPACK: use || in the varint decode range guards #13656 - hrw4u: exit non-zero on compile errors #13699 - hrw4u: add an AST round-trip test over the whole corpus #13675 - hrw4u: enforce sandbox NOT and in on their implicit spellings #13653 - Handle all cachekey regex capture groups #13715 - Test 103 Early Hints before a cached range response #13718 - cache: retry without O_DIRECT for an explicit file span #13560 - Honor allow_half_open when a client aborts early #13455 - Reuse deleted MIME field slots #13677 - Fix global TLS ticket key use for certificate contexts #13717 - tests: cover the global TLSv1.3 session ticket count #13740 - Coverity: avoid unsigned wrap in AIO cache_op loop #13728 - Fix SSL 2.0 version code in JA4 fingerprints #13736 - Bind session ticket keys to the dest_ip certificate #13719 - Hex-encode non-alphanumeric ALPN bytes in JA4 fingerprints #13725 - Include signature algorithms in JA4 fingerprints #13762 - Python 3.15: accommodate PyYAML without CLoader #13761 - Handle OpenSSL 4 handshake buffer exhaustion #13760 - Support OpenSSL 4 certificate accessors in WASM #13695 - Fix HTTP flow control policy reload #13759 - Remove unused globals rejected by Clang 23 #13766 - Harden shutdown against repeated exit signals #13782 - Fix parsing of bodyless HTTP/2 origin responses over 4 KB #13351 - Handle HTTP/2 1xx interim responses from the origin #13447 - HTTP/2 to origin session pool and reliability fixes #13776 - compress: use weak ETags for compressed responses #13783 - Drain an HTTP/2 origin session after it sends GOAWAY #13723 - tests: drive tls_sni_groups with openssl s_client #13780 - Deliver H2 END_STREAM that arrives while read is throttled #13729 - Honor TLS handshake hook pauses on BoringSSL #13763 - Frame empty TLS origin responses in AuTests #13674 - hrw4u: enforce sandbox policy on value functions #13767 - cache: keep the stripe locked after the shutdown dir sync #13559 - Build the well-known-string table at compile time #13376 - Reduce repeated work in HTTP header parsing #13739 - hrw4u: report each sandbox warning at the use that triggers it Fix use-after-free in wasm plugin TXN_CLOSE epilogue Compare h2 Content-Length and payload at full width wasm: Validate metric ID before making API call http: reject HEAD requests carrying Content-Length/Transfer-Encoding Throttle @ header strip logs tsmemcache: bind to loopback by default and add configurable bind address Regex: optionally require whole-subject matches for policy rules Strip unauthorized x-amz- request headers in origin_server_auth CVE-2025-55702 - Fix request with POST Expect: 100-continue Require a matching client certificate for outbound session reuse magick: require signing key and allowlist convert operators origin_server_auth: clarify x-amz- stripping scope in docs and comments proxy: reject resumed TLS sessions missing a required client cert Fix mTLS for TLS resumption scenarios Drop the special case for badly formed 302 responses doc: correct the regex matching contract where sites enforce full match Size chunked passthrough writes without dropped trailers chunked_encoding: add regression test for chunked responses with trailers Reuse an origin connection only after its request body is written doc: record the security release in the release notes Count the Pad Length field in the h2 DATA padding check Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses

FEDORA-EPEL-2026-5a0cf8cf14 Packages in this update:

• trafficserver-10.2.1-1.el10_4

Update description:

Changes with Apache Traffic Server 10.2.1 #13553 - origin_server_auth: Improve log messages #13567 - Metrics: Revert added locking and annotations #13505 - Add hidden metrics and MAX/MIN/incremental derived metric aggregation #13538 - Fix records_yaml startup lookup race #13510 - doc: rate_limit uses max_age, not max-age #13238 - prefetch: move cache key acquisition to CACHE_LOOKUP_COMPLETE #13580 - compress: add Vary to cached client responses #13506 - Per upstream server connection metrics via hidden and derived metrics #13577 - Fix silently dropped Streams.all autest assertions #13110 - Add _reload directive support for config reload framework. #13589 - Skip rate_limit AuTests when plugin not built #13593 - Fix Clang 21 analyzer findings #13576 - Fix client certificate context updates #13578 - Remove dead JSONRPC server_shutdown handler #13227 - Fix data race in SSLCertContext copy & assignment #13642 - Proxy Verifier v3.2.0 #13558 - dns: fix remaining-space tracking when copying address records #13570 - Argparser variable arg option parsing fix/improvement. #13583 - Metrics: close the id lookup race and bounds gaps left by the lock revert #13652 - Restore regex_remap's default PCRE2 match limit #13646 - header_rewrite: build the matcher for %{LAST-CAPTURE} conditions #13514 - Share HTTP accept properties #13645 - Cleanup LogField Registration #13063 - Add changelog generation tool for GitHub milestones #13574 - Fix TransformVConnection leak in abort_tunnel() #13450 - h2origin autest: honor the 30s squid.log wait budget #13672 - header_rewrite: guard the i == 0 case in HRWSimpleTokenizer #13673 - Fix build errors with LLVM 23 #13616 - Allow a metric to be unlisted #13697 - Fix strncasecmp checks that accepted a prefix as equal #13355 - Add --version CLI flag to hrw4u #13666 - Retract per server metrics when the mode changes #13700 - Fix the 9.2 compatibility cache key for paths that carry ";params" #13696 - hrw4u: admit SESSION_VARS as a denyable section #13611 - Make the 9.2 compatibility cache key usable end to end #13571 - Use __atomic builtins as the freelist 128-bit CAS fallback #13655 - QPACK: use || in the varint decode range guards #13656 - hrw4u: exit non-zero on compile errors #13699 - hrw4u: add an AST round-trip test over the whole corpus #13675 - hrw4u: enforce sandbox NOT and in on their implicit spellings #13653 - Handle all cachekey regex capture groups #13715 - Test 103 Early Hints before a cached range response #13718 - cache: retry without O_DIRECT for an explicit file span #13560 - Honor allow_half_open when a client aborts early #13455 - Reuse deleted MIME field slots #13677 - Fix global TLS ticket key use for certificate contexts #13717 - tests: cover the global TLSv1.3 session ticket count #13740 - Coverity: avoid unsigned wrap in AIO cache_op loop #13728 - Fix SSL 2.0 version code in JA4 fingerprints #13736 - Bind session ticket keys to the dest_ip certificate #13719 - Hex-encode non-alphanumeric ALPN bytes in JA4 fingerprints #13725 - Include signature algorithms in JA4 fingerprints #13762 - Python 3.15: accommodate PyYAML without CLoader #13761 - Handle OpenSSL 4 handshake buffer exhaustion #13760 - Support OpenSSL 4 certificate accessors in WASM #13695 - Fix HTTP flow control policy reload #13759 - Remove unused globals rejected by Clang 23 #13766 - Harden shutdown against repeated exit signals #13782 - Fix parsing of bodyless HTTP/2 origin responses over 4 KB #13351 - Handle HTTP/2 1xx interim responses from the origin #13447 - HTTP/2 to origin session pool and reliability fixes #13776 - compress: use weak ETags for compressed responses #13783 - Drain an HTTP/2 origin session after it sends GOAWAY #13723 - tests: drive tls_sni_groups with openssl s_client #13780 - Deliver H2 END_STREAM that arrives while read is throttled #13729 - Honor TLS handshake hook pauses on BoringSSL #13763 - Frame empty TLS origin responses in AuTests #13674 - hrw4u: enforce sandbox policy on value functions #13767 - cache: keep the stripe locked after the shutdown dir sync #13559 - Build the well-known-string table at compile time #13376 - Reduce repeated work in HTTP header parsing #13739 - hrw4u: report each sandbox warning at the use that triggers it Fix use-after-free in wasm plugin TXN_CLOSE epilogue Compare h2 Content-Length and payload at full width wasm: Validate metric ID before making API call http: reject HEAD requests carrying Content-Length/Transfer-Encoding Throttle @ header strip logs tsmemcache: bind to loopback by default and add configurable bind address Regex: optionally require whole-subject matches for policy rules Strip unauthorized x-amz- request headers in origin_server_auth CVE-2025-55702 - Fix request with POST Expect: 100-continue Require a matching client certificate for outbound session reuse magick: require signing key and allowlist convert operators origin_server_auth: clarify x-amz- stripping scope in docs and comments proxy: reject resumed TLS sessions missing a required client cert Fix mTLS for TLS resumption scenarios Drop the special case for badly formed 302 responses doc: correct the regex matching contract where sites enforce full match Size chunked passthrough writes without dropped trailers chunked_encoding: add regression test for chunked responses with trailers Reuse an origin connection only after its request body is written doc: record the security release in the release notes Count the Pad Length field in the h2 DATA padding check Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses

FEDORA-EPEL-2026-d55a762464 Packages in this update:

• trafficserver-10.2.1-1.el10_2

Update description:

Changes with Apache Traffic Server 10.2.1 #13553 - origin_server_auth: Improve log messages #13567 - Metrics: Revert added locking and annotations #13505 - Add hidden metrics and MAX/MIN/incremental derived metric aggregation #13538 - Fix records_yaml startup lookup race #13510 - doc: rate_limit uses max_age, not max-age #13238 - prefetch: move cache key acquisition to CACHE_LOOKUP_COMPLETE #13580 - compress: add Vary to cached client responses #13506 - Per upstream server connection metrics via hidden and derived metrics #13577 - Fix silently dropped Streams.all autest assertions #13110 - Add _reload directive support for config reload framework. #13589 - Skip rate_limit AuTests when plugin not built #13593 - Fix Clang 21 analyzer findings #13576 - Fix client certificate context updates #13578 - Remove dead JSONRPC server_shutdown handler #13227 - Fix data race in SSLCertContext copy & assignment #13642 - Proxy Verifier v3.2.0 #13558 - dns: fix remaining-space tracking when copying address records #13570 - Argparser variable arg option parsing fix/improvement. #13583 - Metrics: close the id lookup race and bounds gaps left by the lock revert #13652 - Restore regex_remap's default PCRE2 match limit #13646 - header_rewrite: build the matcher for %{LAST-CAPTURE} conditions #13514 - Share HTTP accept properties #13645 - Cleanup LogField Registration #13063 - Add changelog generation tool for GitHub milestones #13574 - Fix TransformVConnection leak in abort_tunnel() #13450 - h2origin autest: honor the 30s squid.log wait budget #13672 - header_rewrite: guard the i == 0 case in HRWSimpleTokenizer #13673 - Fix build errors with LLVM 23 #13616 - Allow a metric to be unlisted #13697 - Fix strncasecmp checks that accepted a prefix as equal #13355 - Add --version CLI flag to hrw4u #13666 - Retract per server metrics when the mode changes #13700 - Fix the 9.2 compatibility cache key for paths that carry ";params" #13696 - hrw4u: admit SESSION_VARS as a denyable section #13611 - Make the 9.2 compatibility cache key usable end to end #13571 - Use __atomic builtins as the freelist 128-bit CAS fallback #13655 - QPACK: use || in the varint decode range guards #13656 - hrw4u: exit non-zero on compile errors #13699 - hrw4u: add an AST round-trip test over the whole corpus #13675 - hrw4u: enforce sandbox NOT and in on their implicit spellings #13653 - Handle all cachekey regex capture groups #13715 - Test 103 Early Hints before a cached range response #13718 - cache: retry without O_DIRECT for an explicit file span #13560 - Honor allow_half_open when a client aborts early #13455 - Reuse deleted MIME field slots #13677 - Fix global TLS ticket key use for certificate contexts #13717 - tests: cover the global TLSv1.3 session ticket count #13740 - Coverity: avoid unsigned wrap in AIO cache_op loop #13728 - Fix SSL 2.0 version code in JA4 fingerprints #13736 - Bind session ticket keys to the dest_ip certificate #13719 - Hex-encode non-alphanumeric ALPN bytes in JA4 fingerprints #13725 - Include signature algorithms in JA4 fingerprints #13762 - Python 3.15: accommodate PyYAML without CLoader #13761 - Handle OpenSSL 4 handshake buffer exhaustion #13760 - Support OpenSSL 4 certificate accessors in WASM #13695 - Fix HTTP flow control policy reload #13759 - Remove unused globals rejected by Clang 23 #13766 - Harden shutdown against repeated exit signals #13782 - Fix parsing of bodyless HTTP/2 origin responses over 4 KB #13351 - Handle HTTP/2 1xx interim responses from the origin #13447 - HTTP/2 to origin session pool and reliability fixes #13776 - compress: use weak ETags for compressed responses #13783 - Drain an HTTP/2 origin session after it sends GOAWAY #13723 - tests: drive tls_sni_groups with openssl s_client #13780 - Deliver H2 END_STREAM that arrives while read is throttled #13729 - Honor TLS handshake hook pauses on BoringSSL #13763 - Frame empty TLS origin responses in AuTests #13674 - hrw4u: enforce sandbox policy on value functions #13767 - cache: keep the stripe locked after the shutdown dir sync #13559 - Build the well-known-string table at compile time #13376 - Reduce repeated work in HTTP header parsing #13739 - hrw4u: report each sandbox warning at the use that triggers it Fix use-after-free in wasm plugin TXN_CLOSE epilogue Compare h2 Content-Length and payload at full width wasm: Validate metric ID before making API call http: reject HEAD requests carrying Content-Length/Transfer-Encoding Throttle @ header strip logs tsmemcache: bind to loopback by default and add configurable bind address Regex: optionally require whole-subject matches for policy rules Strip unauthorized x-amz- request headers in origin_server_auth CVE-2025-55702 - Fix request with POST Expect: 100-continue Require a matching client certificate for outbound session reuse magick: require signing key and allowlist convert operators origin_server_auth: clarify x-amz- stripping scope in docs and comments proxy: reject resumed TLS sessions missing a required client cert Fix mTLS for TLS resumption scenarios Drop the special case for badly formed 302 responses doc: correct the regex matching contract where sites enforce full match Size chunked passthrough writes without dropped trailers chunked_encoding: add regression test for chunked responses with trailers Reuse an origin connection only after its request body is written doc: record the security release in the release notes Count the Pad Length field in the h2 DATA padding check Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses

FEDORA-2026-84f58bb437 Packages in this update:

• trafficserver-10.2.1-1.fc45

Update description:

Changes with Apache Traffic Server 10.2.1 #13553 - origin_server_auth: Improve log messages #13567 - Metrics: Revert added locking and annotations #13505 - Add hidden metrics and MAX/MIN/incremental derived metric aggregation #13538 - Fix records_yaml startup lookup race #13510 - doc: rate_limit uses max_age, not max-age #13238 - prefetch: move cache key acquisition to CACHE_LOOKUP_COMPLETE #13580 - compress: add Vary to cached client responses #13506 - Per upstream server connection metrics via hidden and derived metrics #13577 - Fix silently dropped Streams.all autest assertions #13110 - Add _reload directive support for config reload framework. #13589 - Skip rate_limit AuTests when plugin not built #13593 - Fix Clang 21 analyzer findings #13576 - Fix client certificate context updates #13578 - Remove dead JSONRPC server_shutdown handler #13227 - Fix data race in SSLCertContext copy & assignment #13642 - Proxy Verifier v3.2.0 #13558 - dns: fix remaining-space tracking when copying address records #13570 - Argparser variable arg option parsing fix/improvement. #13583 - Metrics: close the id lookup race and bounds gaps left by the lock revert #13652 - Restore regex_remap's default PCRE2 match limit #13646 - header_rewrite: build the matcher for %{LAST-CAPTURE} conditions #13514 - Share HTTP accept properties #13645 - Cleanup LogField Registration #13063 - Add changelog generation tool for GitHub milestones #13574 - Fix TransformVConnection leak in abort_tunnel() #13450 - h2origin autest: honor the 30s squid.log wait budget #13672 - header_rewrite: guard the i == 0 case in HRWSimpleTokenizer #13673 - Fix build errors with LLVM 23 #13616 - Allow a metric to be unlisted #13697 - Fix strncasecmp checks that accepted a prefix as equal #13355 - Add --version CLI flag to hrw4u #13666 - Retract per server metrics when the mode changes #13700 - Fix the 9.2 compatibility cache key for paths that carry ";params" #13696 - hrw4u: admit SESSION_VARS as a denyable section #13611 - Make the 9.2 compatibility cache key usable end to end #13571 - Use __atomic builtins as the freelist 128-bit CAS fallback #13655 - QPACK: use || in the varint decode range guards #13656 - hrw4u: exit non-zero on compile errors #13699 - hrw4u: add an AST round-trip test over the whole corpus #13675 - hrw4u: enforce sandbox NOT and in on their implicit spellings #13653 - Handle all cachekey regex capture groups #13715 - Test 103 Early Hints before a cached range response #13718 - cache: retry without O_DIRECT for an explicit file span #13560 - Honor allow_half_open when a client aborts early #13455 - Reuse deleted MIME field slots #13677 - Fix global TLS ticket key use for certificate contexts #13717 - tests: cover the global TLSv1.3 session ticket count #13740 - Coverity: avoid unsigned wrap in AIO cache_op loop #13728 - Fix SSL 2.0 version code in JA4 fingerprints #13736 - Bind session ticket keys to the dest_ip certificate #13719 - Hex-encode non-alphanumeric ALPN bytes in JA4 fingerprints #13725 - Include signature algorithms in JA4 fingerprints #13762 - Python 3.15: accommodate PyYAML without CLoader #13761 - Handle OpenSSL 4 handshake buffer exhaustion #13760 - Support OpenSSL 4 certificate accessors in WASM #13695 - Fix HTTP flow control policy reload #13759 - Remove unused globals rejected by Clang 23 #13766 - Harden shutdown against repeated exit signals #13782 - Fix parsing of bodyless HTTP/2 origin responses over 4 KB #13351 - Handle HTTP/2 1xx interim responses from the origin #13447 - HTTP/2 to origin session pool and reliability fixes #13776 - compress: use weak ETags for compressed responses #13783 - Drain an HTTP/2 origin session after it sends GOAWAY #13723 - tests: drive tls_sni_groups with openssl s_client #13780 - Deliver H2 END_STREAM that arrives while read is throttled #13729 - Honor TLS handshake hook pauses on BoringSSL #13763 - Frame empty TLS origin responses in AuTests #13674 - hrw4u: enforce sandbox policy on value functions #13767 - cache: keep the stripe locked after the shutdown dir sync #13559 - Build the well-known-string table at compile time #13376 - Reduce repeated work in HTTP header parsing #13739 - hrw4u: report each sandbox warning at the use that triggers it Fix use-after-free in wasm plugin TXN_CLOSE epilogue Compare h2 Content-Length and payload at full width wasm: Validate metric ID before making API call http: reject HEAD requests carrying Content-Length/Transfer-Encoding Throttle @ header strip logs tsmemcache: bind to loopback by default and add configurable bind address Regex: optionally require whole-subject matches for policy rules Strip unauthorized x-amz- request headers in origin_server_auth CVE-2025-55702 - Fix request with POST Expect: 100-continue Require a matching client certificate for outbound session reuse magick: require signing key and allowlist convert operators origin_server_auth: clarify x-amz- stripping scope in docs and comments proxy: reject resumed TLS sessions missing a required client cert Fix mTLS for TLS resumption scenarios Drop the special case for badly formed 302 responses doc: correct the regex matching contract where sites enforce full match Size chunked passthrough writes without dropped trailers chunked_encoding: add regression test for chunked responses with trailers Reuse an origin connection only after its request body is written doc: record the security release in the release notes Count the Pad Length field in the h2 DATA padding check Fix a SIGSEGV in UnixNetVConnection::net_write_io on dechunked POST responses