* SECURITY UPDATE: race condition in ssl.SSLContext.cert_store_stats() and get_ca_certs() - debian/patches/CVE-2024-0397.patch: in Modules/_ssl.c, take a locked copy of the X509_STORE object list (shim of OpenSSL 3.3's X509_STORE_get1_objects()) instead of iterating the live list, so a concurrent certificate load can no longer free entries while they are read. Backport of upstream commit 29c97287d205 (gh-114572, 3.8 branch); the get_ca_certs() failure path releases the result list, as in the original 3.12 fix. - CVE-2024-0397 * SECURITY UPDATE: incorrect "private"/"global" classification of IP address ranges - debian/patches/CVE-2024-4032.patch: in Lib/ipaddress.py, update the is_private / is_global tables to the IANA special-purpose registries and handle IPv4-mapped IPv6 addresses. Backport of upstream commit 895f7e2ac23e (gh-113171, 3.8 branch); the Doc/whatsnew/3.8.rst hunk is dropped. Bundles the upstream regression tests. - CVE-2024-4032 * SECURITY UPDATE: infinite loop or deadlock in tarfile on archives with a negative member offset - debian/patches/CVE-2025-8194.patch: in Lib/tarfile.py, reject negative sizes in TarInfo._block() with InvalidHeaderError. Backport of upstream commit 73f03e4808 (gh-130577, 3.9 branch). Bundles the upstream regression tests, placed by hand in test_tarfile.py. - CVE-2025-8194 * SECURITY UPDATE: use-after-free in a reused bz2/lzma decompressor after MemoryError - debian/patches/CVE-2026-6100.patch: in Modules/_bz2module.c and Modules/_lzmamodule.c, clear next_in on the decompress() error path so a later call no longer reads the caller's released buffer. Backport of upstream commit 47128e64f98c (gh-148395, 3.10 branch). - CVE-2026-6100 * SECURITY UPDATE: IMAP command injection via CR/LF in command arguments - debian/patches/CVE-2025-15366.patch: in Lib/imaplib.py, reject NUL, CR and LF in IMAP4._command() arguments with ValueError, so a caller-supplied argument can no longer smuggle extra IMAP commands. Other control characters are still accepted, following the upstream narrowing of the check. Backport of upstream commit 71926d943c05 (gh-143921, GH-143922 + GH-153067, 3.13 branch). Bundles a regression test adapted to the 3.7 test server. - CVE-2025-15366 * SECURITY UPDATE: POP3 command injection via control characters in command arguments - debian/patches/CVE-2025-15367.patch: in Lib/poplib.py, reject C0 control characters and DEL in POP3._putcmd() with ValueError. Backport of upstream commit b234a2b67539 (gh-143923). Bundles the upstream regression test. - CVE-2025-15367 * SECURITY UPDATE: webbrowser dash-prefix check bypass via "%action" - debian/patches/CVE-2026-4786.patch: in Lib/webbrowser.py, run the CVE-2026-4519 leading-dash check in UnixBrowser.open() on the URL after "%action" is expanded, and substitute "%action" before "%s", so a URL can no longer inject browser options through "%action". Backport of upstream commit d22922c8a795 (gh-148169), taken from the amazonlinux2els 3.7.16 donor. Bundles the upstream regression test. - CVE-2026-4786 * SECURITY UPDATE: email header injection via newlines in generated headers (prerequisite of CVE-2026-1299) - debian/patches/CVE-2024-6923.patch: in Lib/email, encode atoms that contain CR or LF when refolding, and add the verify_generated_headers policy attribute (default True) and email.errors.HeaderWriteError, so Generator refuses to write a header that is improperly folded or delimited. Backport of upstream commit f7be505d137a (gh-121650, 3.9 branch), taken from the amazonlinux2els 3.7.16 donor and adapted to 3.7.3. Bundles the upstream regression tests. - CVE-2024-6923 * SECURITY UPDATE: email header injection through BytesGenerator - debian/patches/CVE-2026-1299.patch: in Lib/email/generator.py, apply the verify_generated_headers checks in BytesGenerator._write_headers() too. Backport of upstream commit 052e55e7d447 (gh-144125), taken from the amazonlinux2els 3.7.16 donor. Bundles the upstream regression tests. - CVE-2026-1299 * Fix email header folding regressions exposed by the header checks above - debian/patches/bpo-34424.patch: in Lib/email/_header_value_parser.py, strip the whole policy.linesep instead of one character when refolding an encoded word, so smtplib.send_message() no longer raises HeaderWriteError on encoded-word headers. Backport of upstream commit c0abd0c8e9b6 (bpo-34424, 3.7.4), applied before CVE-2024-6923.patch. - debian/patches/gh-142006.patch: drop an empty line left in the fold buffer when trailing whitespace is moved to the next line. Backport of upstream commit 90ca216cdcb7 (gh-142006, 3.13 branch).