CVE-2026-29167: mod_ldap use-after-free in per-directory config, deep-copy client_certs
into the connection pool
CVE-2026-34356: mod_proxy heap buffer overflow in ap_proxy_cookie_reverse_map(), reset
newpath/newdomain state on duplicate path=/domain= cookie attributes from a malicious
backend