python
diff --git a/‎whatsnew/changelog.po‎
Lines changed: 17 additions & 1 deletion b/‎whatsnew/changelog.po‎
Lines changed: 17 additions & 1 deletion
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Python 3.11\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-06-27 18:15+0000\n"
+"POT-Creation-Date: 2026-06-29 19:55+0000\n"
 "PO-Revision-Date: 2025-09-22 16:51+0000\n"
 "Last-Translator: python-doc bot, 2026\n"
 "Language-Team: Polish (https://app.transifex.com/python-doc/teams/5390/pl/)\n"
@@ -55,6 +55,15 @@ msgid ""
 "CVE-2025-4330."
 msgstr ""
 
+msgid ""
+":gh:`150743`: :mod:`http.client` now limits the number of chunked-response "
+"trailer lines it will read to 100, and the number of interim (1xx) responses "
+"it will skip to 100.  A malicious or broken server could previously stream "
+"trailer lines or ``100 Continue`` responses forever, hanging the client even "
+"when a socket timeout was in use. Reported by ``@YLChen-007`` via GHSA-w4q2-"
+"g22w-6fr4."
+msgstr ""
+
 msgid ""
 ":gh:`87451`: The :mod:`ftplib` module's undocumented ``ftpcp`` function no "
 "longer trusts the IPv4 address value returned from the source server in "
@@ -90,6 +99,13 @@ msgid ""
 "<https://www.cve.org/CVERecord?id=CVE-2026-4224>`_."
 msgstr ""
 
+msgid ""
+":gh:`145599`: Reject control characters in :class:`http.cookies.Morsel` :"
+"meth:`~http.cookies.Morsel.update` and :meth:`~http.cookies.BaseCookie."
+"js_output`. This addresses `CVE-2026-3644 <https://www.cve.org/CVERecord?"
+"id=CVE-2026-3644>`_."
+msgstr ""
+
 msgid ""
 ":gh:`145506`: Fixes CVE-2026-2297 by ensuring that ``SourcelessFileLoader`` "
 "uses :func:`io.open_code` when opening ``.pyc`` files."