[ Reason ]
Fix CVE-2026-41401 and CVE-2026-44673.

[ Impact ]
Users are vulnerable to heap use-after-free write vulnerability (crash or
potential code execution, CVE-2026-41401) and a heap buffer overflow
(crash or heap corruption, CVE-2026-44673).

[ Tests ]
Both patches have a test included. One from upstream, one developed for this
stable update.

[ Risks ]
The production code changes are trivial and tested thoroughly via the
regression tests.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
The CVE-2026-41401 fix is taken from upstream directly, CVE-2026-44673 is
backported as the affected parser has changed compared to the upstream change
and the code has moved.