- CVE-2026-29167: mod_ldap: use-after-free in per-directory configuration — deep-copy the client certificate list (and referenced path/password strings) into the connection pool instead of a shallow header copy - CVE-2026-29170: mod_proxy_ftp: cross-site scripting in the generated FTP directory listing — escape href filenames with ap_os_escape_path() wrapped in ap_escape_html() instead of ap_escape_uri() - CVE-2026-34355: mod_proxy_html: heap buffer overflow reachable from an untrusted backend — replace hand-rolled buffer management with the ap_varbuf API - CVE-2026-42535: mod_dav_fs: deny WebDAV access to/within the .DAV state directory in dav_fs_get_resource() - CVE-2026-42536: mod_xml2enc: heap buffer overflow in fix_skipto — keep the buffer length (bblen) accounting in sync when advancing the buffer