* SECURITY UPDATE: Memory amplification denial of service in the DTLS record layer: buffering a record that arrives early for the next epoch retained the entire read buffer, sized for the largest possible DTLS record (~16.7KB), rather than only the record's own bytes, so a peer sending a stream of small forged next-epoch records could make an endpoint retain around 1.7MB per connection. - debian/patches/CVE-2026-54874.patch: copy only the record's on-wire bytes into the queue entry and rebase the record pointers on retrieval in ssl/record/rec_layer_d1.c, ssl/record/record.h, ssl/record/record_local.h and ssl/record/ssl3_record.c, and lower the unprocessed_rcds queue limit to 16. - CVE-2026-54874 * SECURITY UPDATE: Out-of-bounds heap write in CMS decryption: the key-unwrap output buffer was sized from the cipher's length query, but the AES-WRAP-PAD unwrap primitive writes and cleanses up to inlen bytes on its integrity-failure paths, so a crafted CMS message naming a padded key-wrap OID caused an 8-byte write past the allocation. - debian/patches/CVE-2026-63072.patch: size the unwrap output buffer for the worst case in cms_kek_cipher() in crypto/cms/cms_kari.c. - CVE-2026-63072