* SECURITY UPDATE: excessive memory use buffering DTLS records - debian/patches/openssl-1.1.1-cve-2026-54874.patch: copy only the record's own on-wire bytes into the queue entry in dtls1_buffer_record(), and copy them back into the live read buffer in dtls1_copy_record(), instead of handing the whole ~16.7KB read buffer to the queue and allocating a fresh one, so a peer sending a stream of tiny next-epoch records can no longer pin ~1.7MB of heap per connection; also lower the cap on the next-epoch (unprocessed_rcds) queue from 100 records to 16, which the same patch passes to dtls1_buffer_record() as an argument so that the other two queues keep the 100-record limit. - CVE-2026-54874