- rebase onto Amazon Linux 2 1.0.2k-24.amzn2.0.23 - CVE-2026-54872: pin the secret scalar and its padded copy to a fixed word count before the BN_add() padding in ec_mul_consttime(), so the work done there no longer varies with the magnitude of the scalar - the TuxCare DTLS retransmission backport (init_off reset in dtls1_retransmit_message(), suspended-write check in dtls1_handle_timeout()) is dropped; the vendor now ships a file of the same name carrying that fix - the TuxCare CRL distribution point backport (relative issuer name built in crl_crldp_check() instead of cached per entry in setup_dp()) is dropped; the vendor now ships a file of the same name carrying that fix