- rebase onto Amazon Linux 2 1.7.3-15.amzn2.0.17; take the vendor's three new patches as Patch1020-Patch1022 and renumber the TuxCare patches to Patch1023-Patch1025. The vendor also renamed its 0.16 fix-buffer-overflow.patch to CVE-2026-81642.patch; the diff payload is byte-identical - CVE-2026-81634: add the missing first owner name and signature length bounds checks to rrset_canonical() in validator/val_sigcrypt.c, preventing a heap buffer overflow during RRset canonicalisation - CVE-2026-82717: carry the vendor's defence-in-depth bounds checks - restore the packet-buffer position on every malformed-name failure in pkt_dname_len(), and validate decompressed-name lengths, packet progress and the trailing copy length in rdata_copy(). 1.7.3 is not affected by the CNAME synthesis write itself: synth_cname_rrset() allocates its own storage with TTL zero and has no cache-min/cache-max rewrite through ttl_data into packet bytes - CVE-2026-85501: bound the DNSSEC work a single query may cause - key-tag matches capped at MAX_TAG_MATCHES (256), NSEC/NSEC3 verifications at MAX_VALIDATE_NSECS (8) per message, and new val-validation-attempts and val-hash-attempts options (default 32) capping signature verifications and DS hash computations per validator query state; oversized referral DS RRsets are shortened in the scrubber and val-clean-additional now defaults to no - keep the TuxCare CVE-2019-16866, CVE-2026-50252 and CVE-2026-33278 (NSEC3 half) backports