* SECURITY UPDATE: Denial of service through a malformed stapled OCSP response during an outbound TLS handshake - debian/patches/CVE-2026-13070.patch: reject an OCSP response that cannot be decoded before attempting certificate-status validation - CVE-2026-13070 * SECURITY UPDATE: Authorization bypass through duplicate fields in a $graphLookup stage - debian/patches/CVE-2026-13060.patch: reject duplicate fields while parsing $graphLookup to keep authorization and execution namespaces consistent - CVE-2026-13060 * SECURITY UPDATE: Out-of-bounds memory access through malformed document diffs supplied to $_internalApplyOplogUpdate - debian/patches/CVE-2026-9753.patch: validate document-diff array bounds and BSONColumn data while applying external oplog updates - CVE-2026-9753 * SECURITY UPDATE: Server crash when a GeoJSON GeometryCollection contains a strict-winding Polygon - debian/patches/CVE-2026-9752.patch: detect strict-winding polygons in geometry collections before projection or 2dsphere indexing - CVE-2026-9752