* SECURITY UPDATE: a resolver using dns64 with break-dnssec could abort on a partially excluded AAAA RRset cached with a NOQNAME proof (use-after-free on the filter64 path) - debian/patches/CVE-2026-19666.patch: clear the NOQNAME proof alias on the DNS64 filter64 path - CVE-2026-19666 * SECURITY UPDATE: a resolver could abort after caching a negative answer of exactly 65536 bytes as a zero-length negative cache record - debian/patches/CVE-2026-19667.patch: reject negative cache records that do not fit in a dns_rdata_t - CVE-2026-19667 * SECURITY UPDATE: a resolver could abort on a wildcard answer whose NOQNAME proof owner carries both a signed NSEC3 and an unsigned NSEC - debian/patches/CVE-2026-80274.patch: record the denial type the validator accepted and use it when caching and serving the NOQNAME proof; adds dns_rdataset_addnoqnametype() to keep the libdns ABI - CVE-2026-80274