Debian 11 Python 3.9 Security Advisory DLA-4455-1 Critical CVE-2025-11468

CVE-2025-12084

When building nested elements using xml.dom.minidom methods such
as appendChild() that have a dependency on _clear_id_cache() the
algorithm was quadratic. Availability could be impacted when building
excessively nested documents.

The fix for this CVE in the previous upload resulted in a regression
in software relying on ownerDocument attribute being always present
in Element instances. This regression has now been fixed.

CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2025-15366, CVE-2025-15367

These are all similar vulnerabilities in the following modules:
http.cookies, wsgiref.headers, imaplib, poplib, urllib. In each of
these control characters were handled incorrectly, allowing injection
of additional cookiers, headers or commands. Control characters are
now rejected in these contexts.

CVE-2025-11468

An issue similar to the above. Comments consisting of a very long