- CVE-2026-1467: validate the URI host, including an IPv6 zone ID, when a message is created or its URI is set; SoupServer answers an invalid request host with 400 - CVE-2026-3632: CR/LF in the URI host can no longer reach the Host header (CVE-2026-1467 host validation) - CVE-2026-3633: reject an HTTP method that is not an RFC 9110 token; SoupServer answers one with 400 - CVE-2026-66339: do not send Proxy-Authorization on a connection that does not go via the proxy (inside a CONNECT tunnel, direct) - CVE-2026-1539: strip Proxy-Authorization on a cross-origin redirect, including credentials negotiated through a 407 - CVE-2026-12547: use cached proxy credentials only for the proxy they came from - CVE-2026-3099: reject replayed and unissued nonces in SoupAuthDomainDigest, with a bounded nonce table and stale=TRUE renewal