The update targets critical vulnerabilities discovered in TLS and HTTP/2 handling that allowed remote server crashes and unauthorized alterations to Server Name Indication during session resumptions. It also resolves medium and low-severity risks, including permission flaws in file system watching and potential proxy credential leaks inside error messages. Furthermore, the deployment upgrades critical embedded dependencies such as brotli 1.2.1, llhttp 9.4.4, sqlite 3.54.1, and undici 7.30.2. Compatibility corrections were also integrated to maintain stability across configured OpenSSL API levels and older OpenSSL 3.0 builds.
Key points
System administrators should deploy the update to protect network infrastructure from hig…: System administrators should deploy the update to protect network infrastructure from high-severity TLS and HTTP/2 remote exploits.
The release mitigates sensitive data exposure risks by preventing proxy credentials from…: The release mitigates sensitive data exposure risks by preventing proxy credentials from leaking into system error messages.
Organizations operating on older OpenSSL 3.0 builds will maintain operational compatibili…: Organizations operating on older OpenSSL 3.0 builds will maintain operational compatibility without sacrificing core security fixes.
Sources checked by our analysis pipeline: 1
Antoine du Hamel
2026-11-11, Version 24.22.3 'Krypton' (LTS), @aduh95
This is a security release.
Notable Changes
- (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
- (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
- (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
- (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
- (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
- (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
- (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
- (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
European regulators are advancing sweeping draft legislation aimed at eliminating manipulative digital designs across e-commerce, gaming, and social networks. The measure is projected to preserve up to €13.7 billion annually for consumers by curbing exploitative commercial tactics. Platforms that fail to comply could face severe penalties reaching up to six percent of their global annual turnover.
Industrial software provider Bright Machines has launched a secure data pipeline to deliver minute-level analytics from inside isolated manufacturing environments. By restricting traffic strictly to an outbound pathway, the architecture avoids exposing sensitive production lines to external network threats. This allows enterprise clients to inspect critical floor metrics without compromising strict plant-level security protocols.
Maintainers have issued a critical Long Term Support update codenamed 'Jod' to patch security vulnerabilities spanning high to low severity across core networking and internal components. The fixes protect enterprise environments by eliminating parser exploits and strengthening secure TLS communications. Adopting this maintenance release prevents potential data leakage and memory retention issues in production runtimes.