- Rebase onto the vendor's 2.72.0-16.el9_8.8 sources - CVE-2026-102556: heap buffer overflow from WebSocket Pong signal type confusion - CVE-2026-102557: heap buffer overflow during WebSocket message reassembly - CVE-2026-102558: heap buffer overflow during WebSocket receive-buffer growth - CVE-2026-102559: heap buffer overflow during WebSocket client-frame masking - CVE-2026-102560: heap buffer overflow during outgoing permessage-deflate buffer growth - All TuxCare ELS patches are retained unchanged: chunked and Content-Length framing in soup-body-input-stream.c, soup-headers.c and soup-message-io.c; header and Range parsing in soup-headers.c and soup-message-headers.c; soup_filter_input_stream_read_until(); cookie and date formatting in soup-cookie.c and soup-date.c; URI host and HTTP method validation in soup-uri.c, soup-message.c and soup-message-server-io.c; Proxy-Authorization handling in soup-auth-manager.c and soup-session.c; digest nonce replay in soup-auth-domain-digest.c; and sniff_unknown() in soup-content-sniffer.c