[ Reason ]
This update includes a variety of CVE fixes for vulnerabilities which do
not warrant separate DSAs.

Address the following issues:

  * Fix CVE-2026-84962: authenticated KMS request forgery via CRLF injection
    in GCP key identifier strings
  * Fix CVE-2026-84971: reject undersized ciphertext before allocating
    plaintext
  * Fix CVE-2026-106429: application denial of service via malformed KMS
    endpoint
  * Fix CVE-2026-106434: unrecognized payload acceptance in explicit decryption
  * Fix CVE-2026-106433: heap corruption via duplicate masterKey fields
  * Fix CVE-2026-114655: KMS request injection via unsanitized key vault and
    provider values

[ Impact ]
Without these fix, users and applications using and integrating
libmongocrypt components may be vulnerable to potential information
modification or disclosure.

[ Tests ]
The affected/changed code went through upstream code reviews. Also,
accompanying unit tests were implemented and executed in upstream's
extensive CI environment.

[ Risks ]
Code changes are minimal (to the extent possible), extensively
reviewed/tested, and low risk. There are no work arounds.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Backport the upstream changes corresponding to the above listed CVEs.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmrqYX0ACgkQldFmTdL1
kUJ3RA/+P4UKcf7vYOM9R9Z6dWDUM+iEu/MH76vjf0wPYDrAqaI2f+mWcBfaadrt
7SWXDJS3UzCZCapZ+Dv/D7OcVZk9hH0ToRM3pM6KFwWFZDhlDSU5GOi6IWDJlFCv
CRCWCONfv309GUDcHMVFvp2MxTmaPr3Yvb5sreOKu87Brcdb+oPkXlOqQ7fjfYiS
e4VamwTXTgRIh/kuYHc/ZMpGp/rtghDHY0C7h8THdwZhHZS6qx94aIZhoQdNJQQP
kmkXtrz0myVj7dtyrHF4SSJcjymFoebN12qPYupwx3/gBoxar/LM96mgVH1lwdD9
Dw8qkU5GKSImi+AH/9WWzwJLt9NhXlKmDpA0WkdTrjH+QGDmbsLpQ+phzt7mxvNl
ffw1HH9evp8fpQLJoQUK2Eaqg3gIV7HvexCJbUbHGNSLKzYSdW/+jtq/3UNMJTtO
eKk8Q0LmyzRg4okxiNPuQz1gJBD9dDJyog84AqIpMz9YwL13Euc2ZXrXuJhGlpjb
IpLgWxhho81LiIW3ISCxQ94JyRNXUzz8LWksIzPLUG9ITN2R62QlzHtFXN36jgq1
q92dqDmHSeyULllKmzVLR/mV0NBnWaDX5wF+tOmy4bXXLcnHa1Tss4OKkDkFvaZ2
ONUeZ40Z9quLHOirZrONMEv7+YEHAw5tGkoTSQWcVVgkaiAl30U=
=z8C+
-----END PGP SIGNATURE-----