[ Reason ]
Fixes for CVE-2026-52747 and CVE-2026-52761

[ Impact ]
Security rules bypass.

[ Tests ]
Fixed and tested by upstream.

[ Risks ]
Low risk, simple patch.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Preserve line breaks from non-file form-field values.
Fix returned length of "unicode" variable.

Hi Alberto,

As this proposed update targets 'bookworm'. Debian bookworm is now
handed over to the LTS team, so no point releases are happening
anymore, but updates are released via DLA's. I'm cc'ing the LTS list.

Regards,
Salvatore

Hello Alberto,
https://lts-team.pages.debian.net/wiki/Development.html

We can help with the administrative tasks.

According to:
https://security-tracker.debian.org/tracker/source-package/modsecurity
this is also an opportunity to fix CVE-2024-1019.

Cheers!
Sylvain Beucler
Debian LTS Team