libhttp-daemon-perl (6.17-1) unstable; urgency=medium

  * Import upstream version 6.17.
   - Fix CVE-2026-8450: 2-arg open() in send_file() enabled RCE / arbitrary
     file write / response-body exfiltration when a string argument was
     derived from attacker-influenced input. send_file() now uses 3-arg
     open() with an explicit '<' read mode, so the path is always treated as a
     literal filename and 2-arg open() shell-magic shapes ('| cmd', 'cmd |',
     '> path', etc.) are no longer interpreted.
   Closes: #1138050
  * Update years of upstream copyright.
  * Update Upstream-Contact in debian/copyright.
  * Declare compliance with Debian Policy 4.7.4.
  * Remove «Rules-Requires-Root: no», which is the current default.
  * Remove «Priority: optional», which is the current default.

 -- gregor herrmann <gregoa@debian.org>  Wed, 27 May 2026 19:23:34 +0200

libhttp-daemon-perl (6.16-1) unstable; urgency=medium

  * Import upstream version 6.16.
  * Declare compliance with Debian Policy 4.6.2.
  * Remove debian/patches/CVE-2022-31081*
    as this is fixed in this release.
  * Update years of packaging copyright.

 -- gregor herrmann <gregoa@debian.org>  Sat, 25 Feb 2023 02:48:14 +0100

libhttp-daemon-perl (6.14-2) unstable; urgency=medium

  * Team upload.
  * Disable CVE-2022-31081-testcase.patch for now as it uses
    HTTP::Tiny internals that have changed in newer versions.
    (Closes: #1016761)

 -- Niko Tyni <ntyni@debian.org>  Thu, 29 Sep 2022 21:57:06 +0300

libhttp-daemon-perl (6.14-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * CVE-2022-31081 (Closes: #1014808)
    improved Content-Length: handling in HTTP-header

 -- Thorsten Alteholz <debian@alteholz.de>  Tue, 26 Jul 2022 20:08:59 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libhttp-daemon-perl`.
