up to 5.3.26. fixes CVE-2013-2110