CLSA-2026-1791403476 Fix CVE(s): CVE-2026-94054, CVE-2026-94056

SECURITY UPDATE: out-of-bounds access in Proxy-Protocol v1 header parsing with an attacker-controlled proxy - debian/patches/CVE-2026-94054.patch: set ret to the length of the heap copy of the PROXY v1 line instead of adding the swallowuntilcrlf count, so the memchr for the CR stays inside the co...

CVE-2019-13118

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data...

PT-2019-4668

Name of the Vulnerable Software and Affected Versions libxslt version 1.1.33 Nokogiri versions prior to 1.10.5 Description The issue arises from insufficient input validation in the xsltNumberFormatDecimal function of the libxslt library. This could allow a remote attacker to gain unauthorized...