diff -urpN zk/CHANGES zl_p1/CHANGES
--- zk/CHANGES	2025-08-06 15:26:27.078598543 +0200
+++ zl_p1/CHANGES	2025-08-06 14:52:13.741941258 +0200
@@ -7,7 +7,58 @@
  https://github.com/openssl/openssl/commits/ and pick the appropriate
  release branch.
 
- Changes between 1.0.2zj and 1.0.2zk [26 Jun 2024]
+ Changes between 1.1.1za and 1.1.1zb [16 Oct 2024]
+
+ *) Harden BN_GF2m_poly2arr against misuse
+
+    The BN_GF2m_poly2arr() function converts characteristic-2 field
+    (GF_{2^m}) Galois polynomials from a representation as a BIGNUM bitmask,
+    to a compact array with just the exponents of the non-zero terms.
+
+    These polynomials are then used in BN_GF2m_mod_arr() to perform modular
+    reduction.  A precondition of calling BN_GF2m_mod_arr() is that the
+    polynomial must have a non-zero constant term (i.e. the array has `0` as
+    its final element).
+
+    Internally, callers of BN_GF2m_poly2arr() did not verify that
+    precondition, and binary EC curve parameters with an invalid polynomial
+    could lead to out of bounds memory reads and writes in BN_GF2m_mod_arr().
+
+    The precondition is always true for polynomials that arise from the
+    standard form of EC parameters for characteristic-two fields (X9.62).
+    See the "Finite Field Identification" section of:
+
+    https://www.itu.int/ITU-T/formal-language/itu-t/x/x894/2018-cor1/ANSI-X9-62.html
+
+    The OpenSSL GF(2^m) code supports only the trinomial and pentanomial
+    basis X9.62 forms.
+
+    This commit updates BN_GF2m_poly2arr() to return `0` (failure) when
+    the constant term is zero (i.e. the input bitmask BIGNUM is not odd).
+
+    Additionally, the return value is made unambiguous when there is not
+    enough space to also pad the array with a final `-1` sentinel value.
+    The return value is now always the number of elements (including the
+    final `-1`) that would be filled when the output array is sufficiently
+    large.  Previously the same count was returned both when the array has
+    just enough room for the final `-1` and when it had only enough space
+    for non-sentinel values.
+
+    Finally, BN_GF2m_poly2arr() is updated to reject polynomials whose
+    degree exceeds `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against
+    CPU exhausition attacks via excessively large inputs.
+
+    The above issues do not arise in processing X.509 certificates.  These
+    generally have EC keys from "named curves", and RFC5840 (Section 2.1.1)
+    disallows explicit EC parameters.  The TLS code in OpenSSL enforces this
+    constraint only after the certificate is decoded, but, even if explicit
+    parameters are specified, they are in X9.62 form, which cannot represent
+    problem values as noted above.
+
+    (CVE-2024-9143)
+    [Viktor Dukhovni]
+
+ Changes between 1.0.2zj and 1.0.2zk [27 May 2024]
 
  *) Fixed possible buffer overread in SSL_select_next_proto().
 
diff -urpN zk/NEWS zl_p1/NEWS
--- zk/NEWS	2023-11-06 11:20:03.000000000 +0100
+++ zl_p1/NEWS	2025-08-06 15:29:09.275399728 +0200
@@ -5,9 +5,18 @@
   This file gives a brief overview of the major changes between each OpenSSL
   release. For more details please read the CHANGES file.
 
-  Major changes between OpenSSL 1.0.2zi and OpenSSL 1.0.2zj [under development]
+  Major changes between OpenSSL 1.0.2zk and OpenSSL 1.0.2zl [16 Oct 2024]
 
-      o
+      o Harden BN_GF2m_poly2arr against misuse
+
+  Major changes between OpenSSL 1.0.2zj and OpenSSL 1.0.2zk [26 Jun 2024]
+
+      o Fix SSL_select_next_proto
+
+  Major changes between OpenSSL 1.0.2zi and OpenSSL 1.0.2zj [25 Jan 2024]
+
+      o Add NULL checks where ContentInfo data can be NULL
+      o Make DH_check_pub_key() and DH_generate_key() safer yet
 
   Major changes between OpenSSL 1.0.2zh and OpenSSL 1.0.2zi [1 Aug 2023]
 
diff -urpN zk/README zl_p1/README
--- zk/README	2023-11-06 11:20:03.000000000 +0100
+++ zl_p1/README	2025-08-06 15:29:34.400167630 +0200
@@ -1,5 +1,5 @@
 
- OpenSSL 1.0.2zj-dev
+ OpenSSL 1.0.2zl-sec 16 Oct 2024
 
  Copyright (c) 1998-2023 The OpenSSL Project
  Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
diff -urpN zk/crypto/bn/bn_gf2m.c zl_p1/crypto/bn/bn_gf2m.c
--- zk/crypto/bn/bn_gf2m.c	2023-11-06 11:20:03.000000000 +0100
+++ zl_p1/crypto/bn/bn_gf2m.c	2025-08-06 15:33:34.663406829 +0200
@@ -96,6 +96,7 @@
 #include "bn_lcl.h"
 
 #ifndef OPENSSL_NO_EC2M
+#include <openssl/ec.h>
 
 /*
  * Maximum number of iterations before BN_GF2m_mod_solve_quad_arr should
@@ -1245,16 +1246,26 @@ int BN_GF2m_mod_solve_quad(BIGNUM *r, co
 /*
  * Convert the bit-string representation of a polynomial ( \sum_{i=0}^n a_i *
  * x^i) into an array of integers corresponding to the bits with non-zero
- * coefficient.  Array is terminated with -1. Up to max elements of the array
- * will be filled.  Return value is total number of array elements that would
- * be filled if array was large enough.
+ * coefficient.  The array is intended to be suitable for use with
+ * `BN_GF2m_mod_arr()`, and so the constant term of the polynomial must not be
+ * zero.  This translates to a requirement that the input BIGNUM `a` is odd.
+ *
+ * Given sufficient room, the array is terminated with -1.  Up to max elements
+ * of the array will be filled.
+ *
+ * The return value is total number of array elements that would be filled if
+ * array was large enough, including the terminating `-1`.  It is `0` when `a`
+ * is not odd or the constant term is zero contrary to requirement.
+ *
+ * The return value is also `0` when the leading exponent exceeds
+ * `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against CPU exhaustion attacks,
  */
 int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
 {
     int i, j, k = 0;
     BN_ULONG mask;
 
-    if (BN_is_zero(a))
+    if (!BN_is_odd(a))
         return 0;
 
     for (i = a->top - 1; i >= 0; i--) {
@@ -1272,12 +1283,13 @@ int BN_GF2m_poly2arr(const BIGNUM *a, in
         }
     }
 
-    if (k < max) {
+    if (k > 0 && p[0] > OPENSSL_ECC_MAX_FIELD_BITS)
+        return 0;
+
+    if (k < max)
         p[k] = -1;
-        k++;
-    }
 
-    return k;
+    return k + 1;
 }
 
 /*
diff -urpN zk/crypto/opensslv.h zl_p1/crypto/opensslv.h
--- zk/crypto/opensslv.h	2025-08-06 15:26:47.141272809 +0200
+++ zl_p1/crypto/opensslv.h	2025-08-06 15:34:13.642682449 +0200
@@ -30,11 +30,11 @@ extern "C" {
  * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
  *  major minor fix final patch/beta)
  */
-# define OPENSSL_VERSION_NUMBER  0x1000224fL
+# define OPENSSL_VERSION_NUMBER  0x1000225fL
 # ifdef OPENSSL_FIPS
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2zk-fips-sec  26 Jun 2024"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2zl-fips-sec  16 Oct 2024"
 # else
-#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2zk-sec  26 Jun 2024"
+#  define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.2zl-sec  16 Oct 2024"
 # endif
 # define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT