SECURITY UPDATE: wrong handler on internal redirect from a CGI program
debian/patches/CVE-2026-42356.patch: do not propagate the trusted
content-type flag to the target of an internal redirect in
ap_internal_redirect_handler() in modules/http/http_request.c.