Count empty towards against limit

Close rejected listeners at Accept

Fix packet connection leak

Fix panic unmarshaling ECDHE_PSK ClientKeyExchange

Add a bounds check before reading the ECDHE public key length when
the PSK identity hint consumes the whole body. Also bound the
PublicKey clone by the declared public key length, matching the
ServerKeyExchange handling.

Unblock reads when conn is closed

Retact v3.1.3 for breaking compatiblity with firefox

Fix panic unmarshaling ECDHE_PSK ServerKeyExchange

Missing bounds check a invalid ServerKeyExchange message
could cause crash.

Retract v3.1.0

Retract v3.1.0

Backport security fix for CVE-2026-26014