SECURITY UPDATE: code execution via state corruption after an
out-of-memory error and via stale global state
debian/patches/CVE-2026-109618.patch: terminate the process on memory
limit and allocation overflow errors instead of unwinding, clear
request globals at shutdown, disable session upload progress and keep
only the Content-Disposition and Content-Type multipart part headers.