[renovate]

This PR contains the following updates:

Package	Update	Change
openssl/openssl	major	3.6.4 → 4.1.0

---

Release Notes

openssl/openssl

v4.1.0: OpenSSL 4.1.0

Compare Source

OpenSSL 4.1.0 is a feature release adding significant new functionality
to OpenSSL.

This release incorporates the following potentially significant or incompatible
changes:

• Added VC-WIN32-MSVC2013 and VC-WIN64A-MSVC2013 build targets to provide
  internal functions for bridging the gaps in C99 standard support
  that are present in MSVC 2013.

• Added optimized ML-DSA and ML-KEM NTT operations on ppc64le;
  optimized ML-DSA operations on x86_64;
  AVX-512-optimized SHAKE x4 operations for ML-DSA on x86_64;
  AVX-512 and VAES optimizations for AES-CBC decryption on x86_64.

• Changed tsget utility to use Net::Curl::Easy (from the Net-Curl CPAN
  distribution) instead of the abandoned WWW::Curl::Easy. Users who rely
  on tsget should install Net::Curl::Easy before upgrading.

• Dropped Windows-on-Itanium (VC-WIN64I) and Windows CE (VC-CE) targets
  from Configurations.

• Dropped no-ecdsa and no-ecdh options from Configure, as these options
  did not really disable the implementations. Use no-ec to disable
  the elliptic curve support.

This release adds the following new features:

• Support for DTLS 1.3 (RFC 9147).
  Refer to the ossl-guide-dtlsv13(7) manual page for details.

• Support for RFC 8701 GREASE (Generate Random Extensions And Sustain
  Extensibility).

• DTLS support in the SSL listener API.

• Support for IKEV2 KDF.

• Initial support for the Elbrus2000 (e2k) architecture.

Known issues in 4.1.0:

• #​32878
  When a DTLS 1.3 KeyUpdate is received, all other outstanding
  post-handshake records are dropped from the retransmission buffer.
  This means post-handshake records still awaiting an ACK (such as a
  NewSessionTicket) will no longer be retransmitted if the original
  transmission is lost. A fix is in progress and planned for a future
  release.

• #​33277
  A permanent receive failure on a DTLS listener can be reported as
  SSL_ERROR_WANT_READ on an accepted connection. Polling and subsequent
  accept calls may also fail to report the error, causing applications
  to continue waiting after a permanent failure.

• #​33278
  A retryable write failure on a nonblocking connection accepted from a
  DTLS listener can be reported as SSL_ERROR_SYSCALL instead of
  SSL_ERROR_WANT_WRITE. Applications treating this result as fatal may
  close a connection that is still usable.

• #​33242
  DTLS 1.3 servers may abort handshakes with an unexpected_message alert
  when a client acknowledges part or all of the server's first flight
  before sending its response. This can occur after packet loss or while
  the client is preparing its authentication response.

v4.0.3

Compare Source

• Fixed DTLS retransmissions of handshake messages from a stale buffer offset.

  Severity: High

  Issue summary: The DTLS retransmission logic does not correctly handle
  a handshake message write that is suspended part-way through.
  The retransmitted message can be read past the message buffer
  and the retransmission overwrites the internal state the suspended write
  needs to resume correctly.

  Impact summary: The retransmitted message can disclose a heap memory
  to the peer as plaintext handshake data or cause a crash and a Denial
  of Service when the read reaches an unmapped memory region.

  Reported by: Laurent Gaffie (secorizon.com).

  ([CVE-2026-84782])

  Ryan Hooper

• Fixed a use-after-free in X.509 extension cache under concurrent use.

  Severity: Moderate

  Issue summary: The first concurrent use of the same X.509 certificate
  by several threads may cause its cached extension data to be freed
  while another thread is still using it.

  Impact summary: A remote, unauthenticated peer could crash a multi-threaded
  TLS client, or a multi-threaded TLS server that requests client certificates,
  if the first certificate chains built to the same trusted CA certificate
  are built by several connections at the same time. This is a use-after-free
  read, which is likely to crash the process, resulting in a Denial of Service.

  Reported by: Tim Becker (Xint.io) and Aydın Mercan.

  ([CVE-2026-84783])

  Bob Beck

• Fixed excessive memory allocation in relative CRLDP processing.

  Severity: Low

  Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
  distribution points causes disproportionate heap growth when OpenSSL caches
  X.509 extensions.

  Impact summary: Receiving a crafted certificate from a malicious peer
  can lead to significant memory pressure and possible Denial of Service
  in clients or in servers that solicit client certificates.

  Reported by: Fuzz0x (ZKSC Institute of Security Research).

  ([CVE-2026-35189])

  Viktor Dukhovni

• Fixed QUIC unvalidated amplification credit may be over-accounted.

  Severity: Low

  Issue summary: The OpenSSL QUIC server, when configured to not perform
  address validation, can be forced to count incoming packets multiple times
  in its unvalidated credit computation, leading to a violation
  of the [RFC 9000] unvalidated connection amplification limit of 3 times
  the amount of data received.

  Impact summary: A remote attacker, who is able to spoof packets to a server
  using the OpenSSL QUIC implementation, might use the server
  for an amplification of a Distributed Denial of Service attack.

  Reported by: Ali Firas and Nikolas Gauder (NVIDIA).

  ([CVE-2026-35191])

  Neil Horman

• Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.

  Severity: Low

  Issue summary: The QUIC stream reassembly algorithm performance deteriorates
  progressively as packets are arriving out of order. The worst case has
  a quadratic complexity, proportional to the number of stream frames kept
  in the buffer for the received stream data.

  Impact summary: A remote QUIC peer that completes the handshake can create
  a connection-scoped CPU pressure and potentially a Denial of Service using
  compliant STREAM frames inside the advertised receive window, with low
  attacker bandwidth.

  Reported by: Saku0512 and Opal Wright (Trail of Bits) in collaboration
  with OpenAI

  ([CVE-2026-42772])

  Alexandr Nedvědický

• Fixed a timing side-channel leak in generic elliptic curve scalar
  multiplication.

  Severity: Low

  Issue summary: The generic elliptic-curve scalar multiplication, used
  for ECDSA and SM2 signature operations with curves that do not have
  a dedicated implementation, leaks information about the secret nonce
  through timing.

  Impact summary: An attacker, who is able to measure signing times, may learn
  information about the per-signature secret nonce, which over many signatures
  can, via a Hidden Number Problem (lattice) attack, lead to recovery
  of the private key.

  Reported by: Alicja Kario and George Pantelakis (Red Hat), based
  on the report of Youngjae Choi (Korea University).

  ([CVE-2026-54872])

  Igor Ustinov

• Fixed QUIC STREAM fragment metadata DoS.

  Severity: Low

  Issue summary: QUIC process may keep memory for QUIC packet buffer
  for much longer period than necessary.

  Impact summary: Remote peer can exploit this vulnerability by sending
  maliciously crafted packets, making the local QUIC stack to keep the memory
  for packet buffers allocated. The time for which the memory remains
  allocated is entirely under the control of the potentially malicious remote
  peer.

  Reported by: Zhen Yan (AntAISecurityLab) and Bhabani Sankar Das.

  ([CVE-2026-54873])

  Alexandr Nedvědický

• Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.

  Severity: Low

  Issue summary: A non-constant-time optimized implementation of scalar
  point multiplication is used for SM2 private key operations on ARM64
  and RISC-V platforms.

  Impact summary: An attacker able to measure the time taken by, or to observe
  the cache-line access pattern of, SM2 signing or decryption on an affected
  platform can learn information about the secret scalar.

  Reported by: Abhinav Agarwal and Feng Xue.

  ([CVE-2026-54875])

  Igor Ustinov

• Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake.

  Severity: Low

  Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch
  a connection to a different SSL_CTX part way through a handshake may access
  memory beyond the end of an internal array if the replacement context knows
  about more provider signature algorithms than the context the connection was
  created from. Applications that never call SSL_set_SSL_CTX()
  are not affected.

  Impact summary: A remote peer may be able to cause a small out-of-bounds
  read, and, in some circumstances, a fixed-value out-of-bounds write,
  on the server heap. This may lead to a Denial of Service.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
  Brandon Luo, Luigino Camastra (Aisle Research), and Bhargava Shastry.

  ([CVE-2026-72897])

  Matt Caswell

• Fixed QUIC connection-level flow control was not enforced for streams.

  Severity: Low

  Issue summary: OpenSSL QUIC stack does not enforce connection-level flow
  control for streams. Remote peers may send more bytes, as long as they fit
  within the stream flow control limits.

  Impact summary: A malicious remote peer may exploit the lack of connection
  flow control for streams to make the QUIC stack receive ~100 MiB of memory
  instead of 768 KiB (default flow control window size).

  Reported by: Moltenbit, Bhabani Sankar Das, Saiyowa Security Team, mzfr.

  ([CVE-2026-75804])

  Alexandr Nedvědický

• Fixed a NULL pointer dereference in CMP client revocation response handling.

  Severity: Low

  Issue summary: The OpenSSL Certificate Management Protocol (CMP) client
  that requests a certificate revocation on the basis of a PKCS#10 CSR may
  dereference a NULL pointer and terminate abnormally when processing a crafted
  revocation response.

  Impact summary: The NULL pointer dereference happens on a read, which
  leads to a crash and a Denial of Service for the affected client application.

  Reported by: Bhabani Sankar Das.

  ([CVE-2026-75805])

  Bhabani Sankar Das and Norbert Pócs

• Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.

  Severity: Low

  Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
  can be terminated by a single unauthenticated datagram whose encrypted
  fragment is shorter than the mandatory explicit IV and authentication tag
  overhead.

  Impact summary: An attacker who can send a datagram that is routed
  to an existing DTLS 1.2 association can tear that association down
  without knowing any key material. This is a Denial of Service, limited
  to the targeted association. There is no memory safety or confidentiality
  impact.

  Reported by: Mounir IDRASSI.

  ([CVE-2026-75806])

  Mounir IDRASSI

• Fixed a timing side-channel in SM2 signature generation.

  Severity: Low

  Issue summary: SM2 signature generation uses non-constant-time arithmetic
  on secret values, forming a timing side-channel.

  Impact summary: An attacker able to measure SM2 signing times may learn
  information about the per-signature secret nonce, which over many signatures
  can, via a Hidden Number Problem (lattice) attack, lead to recovery
  of the private key.

  Reported by: Vladimir Tokarev.

  ([CVE-2026-77696])

  Igor Ustinov and Viktor Dukhovni

• Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack
  implementation.

  Severity: Low

  Issue summary: A malicious remote peer may flood the local QUIC stack
  with NEW_CONNECTION_ID frames by avoiding a limit check on how many
  connection IDs the remote QUIC stack can use.

  Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame
  for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID
  frame is dispatched via the Control Frame Queue (CFQ). If the remote
  peer also withholds ACKs, then it can force the local stack to allocate
  up to ~400 MB (depending on ACK delay).

  Reported by: Bhabani Sankar Das.

  ([CVE-2026-84784])

  Alexandr Nedvědický

• Fixed a bug where EVP_DecryptFinal() incorrectly reported a stale success
  on AES-SIV authentication failure after a previously successful message
  decryption.

  Abel Thomas

• Fixed a regression in base64 encoding BIO filter introduced in OpenSSL 4.0,
  where incomplete writes down the BIO chain may result in the loss of encoded
  base64 data.

  Mounir IDRASSI

• Fixed a bug in OSSL_HTTP_get() that allowed to perform HTTPS-to-HTTP
  downgrade through a relative redirect.

  Mounir IDRASSI

• Changed the OpenSSL FIPS provider so that every algorithm advertised
  with fips=yes property explicitly exposes a fips-indicator gettable
  context parameter, that returns 1 for an approved operation. The absence
  of an indicator is no longer interpreted as approval. Algorithms advertised
  with fips=no property, including X448MLKEM1024, remain unapproved
  and return 0 when they expose the indicator.

  Shane Lontis and Paul Dale

• Changed the compiler flags supplied to MSVC targets to no longer include
  /Gs0 (resetting the minimum memory size occupied by local variables
  for including stack probes to the default value of 4096), as it led
  to mis-compilation of MD4 C implementation on ARM64.

  Norbert Pócs

v4.0.2

Compare Source

• Fixed DTLS retransmissions of handshake messages from a stale buffer offset.

  Severity: High

  Issue summary: The DTLS retransmission logic does not correctly handle
  a handshake message write that is suspended part-way through.
  The retransmitted message can be read past the message buffer
  and the retransmission overwrites the internal state the suspended write
  needs to resume correctly.

  Impact summary: The retransmitted message can disclose a heap memory
  to the peer as plaintext handshake data or cause a crash and a Denial
  of Service when the read reaches an unmapped memory region.

  Reported by: Laurent Gaffie (secorizon.com).

  ([CVE-2026-84782])

  Ryan Hooper

• Fixed a use-after-free in X.509 extension cache under concurrent use.

  Severity: Moderate

  Issue summary: The first concurrent use of the same X.509 certificate
  by several threads may cause its cached extension data to be freed
  while another thread is still using it.

  Impact summary: A remote, unauthenticated peer could crash a multi-threaded
  TLS client, or a multi-threaded TLS server that requests client certificates,
  if the first certificate chains built to the same trusted CA certificate
  are built by several connections at the same time. This is a use-after-free
  read, which is likely to crash the process, resulting in a Denial of Service.

  Reported by: Tim Becker (Xint.io) and Aydın Mercan.

  ([CVE-2026-84783])

  Bob Beck

• Fixed excessive memory allocation in relative CRLDP processing.

  Severity: Low

  Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
  distribution points causes disproportionate heap growth when OpenSSL caches
  X.509 extensions.

  Impact summary: Receiving a crafted certificate from a malicious peer
  can lead to significant memory pressure and possible Denial of Service
  in clients or in servers that solicit client certificates.

  Reported by: Fuzz0x (ZKSC Institute of Security Research).

  ([CVE-2026-35189])

  Viktor Dukhovni

• Fixed QUIC unvalidated amplification credit may be over-accounted.

  Severity: Low

  Issue summary: The OpenSSL QUIC server, when configured to not perform
  address validation, can be forced to count incoming packets multiple times
  in its unvalidated credit computation, leading to a violation
  of the [RFC 9000] unvalidated connection amplification limit of 3 times
  the amount of data received.

  Impact summary: A remote attacker, who is able to spoof packets to a server
  using the OpenSSL QUIC implementation, might use the server
  for an amplification of a Distributed Denial of Service attack.

  Reported by: Ali Firas and Nikolas Gauder (NVIDIA).

  ([CVE-2026-35191])

  Neil Horman

• Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.

  Severity: Low

  Issue summary: The QUIC stream reassembly algorithm performance deteriorates
  progressively as packets are arriving out of order. The worst case has
  a quadratic complexity, proportional to the number of stream frames kept
  in the buffer for the received stream data.

  Impact summary: A remote QUIC peer that completes the handshake can create
  a connection-scoped CPU pressure and potentially a Denial of Service using
  compliant STREAM frames inside the advertised receive window, with low
  attacker bandwidth.

  Reported by: Saku0512 and Opal Wright (Trail of Bits) in collaboration
  with OpenAI

  ([CVE-2026-42772])

  Alexandr Nedvědický

• Fixed a timing side-channel leak in generic elliptic curve scalar
  multiplication.

  Severity: Low

  Issue summary: The generic elliptic-curve scalar multiplication, used
  for ECDSA and SM2 signature operations with curves that do not have
  a dedicated implementation, leaks information about the secret nonce
  through timing.

  Impact summary: An attacker, who is able to measure signing times, may learn
  information about the per-signature secret nonce, which over many signatures
  can, via a Hidden Number Problem (lattice) attack, lead to recovery
  of the private key.

  Reported by: Alicja Kario and George Pantelakis (Red Hat), based
  on the report of Youngjae Choi (Korea University).

  ([CVE-2026-54872])

  Igor Ustinov

• Fixed QUIC STREAM fragment metadata DoS.

  Severity: Low

  Issue summary: QUIC process may keep memory for QUIC packet buffer
  for much longer period than necessary.

  Impact summary: Remote peer can exploit this vulnerability by sending
  maliciously crafted packets, making the local QUIC stack to keep the memory
  for packet buffers allocated. The time for which the memory remains
  allocated is entirely under the control of the potentially malicious remote
  peer.

  Reported by: Zhen Yan (AntAISecurityLab) and Bhabani Sankar Das.

  ([CVE-2026-54873])

  Alexandr Nedvědický

• Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.

  Severity: Low

  Issue summary: A non-constant-time optimized implementation of scalar
  point multiplication is used for SM2 private key operations on ARM64
  and RISC-V platforms.

  Impact summary: An attacker able to measure the time taken by, or to observe
  the cache-line access pattern of, SM2 signing or decryption on an affected
  platform can learn information about the secret scalar.

  Reported by: Abhinav Agarwal and Feng Xue.

  ([CVE-2026-54875])

  Igor Ustinov

• Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake.

  Severity: Low

  Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch
  a connection to a different SSL_CTX part way through a handshake may access
  memory beyond the end of an internal array if the replacement context knows
  about more provider signature algorithms than the context the connection was
  created from. Applications that never call SSL_set_SSL_CTX()
  are not affected.

  Impact summary: A remote peer may be able to cause a small out-of-bounds
  read, and, in some circumstances, a fixed-value out-of-bounds write,
  on the server heap. This may lead to a Denial of Service.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
  Brandon Luo, Luigino Camastra (Aisle Research), and Bhargava Shastry.

  ([CVE-2026-72897])

  Matt Caswell

• Fixed QUIC connection-level flow control was not enforced for streams.

  Severity: Low

  Issue summary: OpenSSL QUIC stack does not enforce connection-level flow
  control for streams. Remote peers may send more bytes, as long as they fit
  within the stream flow control limits.

  Impact summary: A malicious remote peer may exploit the lack of connection
  flow control for streams to make the QUIC stack receive ~100 MiB of memory
  instead of 768 KiB (default flow control window size).

  Reported by: Moltenbit, Bhabani Sankar Das, Saiyowa Security Team, mzfr.

  ([CVE-2026-75804])

  Alexandr Nedvědický

• Fixed a NULL pointer dereference in CMP client revocation response handling.

  Severity: Low

  Issue summary: The OpenSSL Certificate Management Protocol (CMP) client
  that requests a certificate revocation on the basis of a PKCS#10 CSR may
  dereference a NULL pointer and terminate abnormally when processing a crafted
  revocation response.

  Impact summary: The NULL pointer dereference happens on a read, which
  leads to a crash and a Denial of Service for the affected client application.

  Reported by: Bhabani Sankar Das.

  ([CVE-2026-75805])

  Bhabani Sankar Das and Norbert Pócs

• Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.

  Severity: Low

  Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
  can be terminated by a single unauthenticated datagram whose encrypted
  fragment is shorter than the mandatory explicit IV and authentication tag
  overhead.

  Impact summary: An attacker who can send a datagram that is routed
  to an existing DTLS 1.2 association can tear that association down
  without knowing any key material. This is a Denial of Service, limited
  to the targeted association. There is no memory safety or confidentiality
  impact.

  Reported by: Mounir IDRASSI.

  ([CVE-2026-75806])

  Mounir IDRASSI

• Fixed a timing side-channel in SM2 signature generation.

  Severity: Low

  Issue summary: SM2 signature generation uses non-constant-time arithmetic
  on secret values, forming a timing side-channel.

  Impact summary: An attacker able to measure SM2 signing times may learn
  information about the per-signature secret nonce, which over many signatures
  can, via a Hidden Number Problem (lattice) attack, lead to recovery
  of the private key.

  Reported by: Vladimir Tokarev.

  ([CVE-2026-77696])

  Igor Ustinov and Viktor Dukhovni

• Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack
  implementation.

  Severity: Low

  Issue summary: A malicious remote peer may flood the local QUIC stack
  with NEW_CONNECTION_ID frames by avoiding a limit check on how many
  connection IDs the remote QUIC stack can use.

  Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame
  for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID
  frame is dispatched via the Control Frame Queue (CFQ). If the remote
  peer also withholds ACKs, then it can force the local stack to allocate
  up to ~400 MB (depending on ACK delay).

  Reported by: Bhabani Sankar Das.

  ([CVE-2026-84784])

  Alexandr Nedvědický

• Fixed a bug where EVP_DecryptFinal() incorrectly reported a stale success
  on AES-SIV authentication failure after a previously successful message
  decryption.

  Abel Thomas

• Fixed a regression in base64 encoding BIO filter introduced in OpenSSL 4.0,
  where incomplete writes down the BIO chain may result in the loss of encoded
  base64 data.

  Mounir IDRASSI

• Fixed a bug in OSSL_HTTP_get() that allowed to perform HTTPS-to-HTTP
  downgrade through a relative redirect.

  Mounir IDRASSI

• Changed the OpenSSL FIPS provider so that every algorithm advertised
  with fips=yes property explicitly exposes a fips-indicator gettable
  context parameter, that returns 1 for an approved operation. The absence
  of an indicator is no longer interpreted as approval. Algorithms advertised
  with fips=no property, including X448MLKEM1024, remain unapproved
  and return 0 when they expose the indicator.

  Shane Lontis and Paul Dale

• Changed the compiler flags supplied to MSVC targets to no longer include
  /Gs0 (resetting the minimum memory size occupied by local variables
  for including stack probes to the default value of 4096), as it led
  to mis-compilation of MD4 C implementation on ARM64.

  Norbert Pócs

v4.0.1

Compare Source

• Fixed QUIC server being able to trigger double free when processing INITIAL
  packet.

  Severity: Moderate

  Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
  when channel creation fails for initial packet.

  Impact summary: Double free leads to heap corruption, which typically results
  in termination of QUIC server process, leading to a Denial of Service.
  There is so far no evidence that this double free is exploitable for remote
  code execution, thus it is considered highly improbable.

  Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle,
  and Feng Xue (ThreatBoon).

  ([CVE-2026-18798])

  Alexandr Nedvědický

• Fixed heap buffer overflow in CMS key unwrapping.

  Severity: Moderate

  Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer
  based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap
  primitive can write and cleanse more bytes than that query reports, causing
  an 8-byte out-of-bounds heap write.

  Impact summary: An attacker who supplies a crafted CMS message can trigger
  a deterministic 8-byte out-of-bounds heap write when the victim decrypts it
  with CMS_decrypt(), corrupting the heap and typically resulting in a Denial
  of Service.

  Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits).

  ([CVE-2026-63072])

  Daniel Kubec

• Fixed invalid pointer dereference in CMP server via crafted protectionAlg.

  Severity: Moderate

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP)
  password-based protection verification only checks whether
  the protectionAlg parameter was not NULL and not its ASN.1 type,
  before treating it as a PBMParameter. A crafted message can contain
  a parameter of a different type, which is then dereferenced as an invalid
  pointer.

  Impact summary: A remote, unauthenticated attacker can crash an application
  acting as a CMP server that accepts PBM-protected messages, or a CMP client
  talking to a malicious or intercepted CMP server, resulting in a Denial
  of Service.

  Reported by: Ying Dong and Bhabani Sankar Das.

  ([CVE-2026-63076])

  Daniel Kubec

• Fixed unbounded memory growth in QUIC server incoming channel queue.

  Severity: Low

  Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
  valid QUIC Initial packets for unknown destination connection IDs, it can
  allocate and queue new incoming channels without enforcing any limit.

  Impact summary: A remote peer that can make many INITIAL packets reach
  the server listener faster than the application accepts connections can
  cause the memory allocated to store the per-channel state to grow
  without any limits, potentially making the QUIC listener unavailable
  and causing a Denial of Service.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.

  ([CVE-2026-14456])

  Filipe Casal

• Fixed RPK server signature algorithm selection being able to dereference
  a missing certificate.

  Severity: Low

  Issue summary: In a server or client configuration with [RFC 7250] Raw Public
  Keys (RPKs) enabled, and only the private key (with no associated
  certificate) configured locally, a NULL pointer dereference may occur
  when the remote peer solicits raw public keys and also sends the typically
  omitted signature_algorithms_cert TLS extension.

  Impact summary: The impact is limited to a possible Denial of Service
  as a result of an application abort, no data disclosure or remote command
  execution are possible.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.

  ([CVE-2026-14457])

  Viktor Dukhovni

• Fixed excessive memory use buffering DTLS records for a future epoch.

  Severity: Low

  Issue summary: Receiving a DTLS record for a future epoch while a handshake
  is in progress causes OpenSSL to buffer far more memory than the record
  itself requires.

  Impact summary: A peer can use a small amount of network traffic to make
  an OpenSSL DTLS endpoint retain a disproportionately large amount of memory,
  which may lead to a Denial of Service.

  Reported by: Amazon Web Services.

  ([CVE-2026-54874])

  Matt Caswell

• Fixed client-side memory leak in OCSP response checking.

  Severity: Low

  Issue summary: A malicious TLS server can cause a memory leak in a TLS
  client that has enabled OCSP response checking by sending an OCSP response
  that contains no single response entries.

  Impact summary: An attacker can leak an attacker-tunable amount of memory
  per TLS handshake in a victim client application. A long-running client
  that repeatedly connects to a malicious server can have its memory
  exhausted, resulting in a Denial of Service.

  Reported by: Bhabani Sankar Das and Zhenzhe Shao.

  ([CVE-2026-54876])

  Mounir IDRASSI

• Fixed untrusted Sender DN being used as a format string in CMP response
  validation.

  Severity: Low

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response
  validation passed an unexpected response sender distinguished name directly
  as the format string to ERR_raise_data().

  Impact summary: A malicious or intercepted CMP endpoint can crash a CMP
  client that enforces an expected sender or uses a pinned server certificate
  whose subject becomes the default expected sender.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
  Brandon Luo, and TrendAI Zero Day Initiative.

  ([CVE-2026-63073])

  Filipe Casal

• Fixed CMP indefinite cache growth of extraCerts.

  Severity: Low

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches
  additional certificates (extraCerts) sent in a CMP message, but never
  expunges them (for instance, if they are invalid). If a server reuses
  an OSSL_CMP_CTX object frequently, this cache of extraCerts may grow
  unboundedly, and a malicious client may flood a CMP server with requests
  driving this growth.

  Impact Summary: Users utilizing a CMP server that reuses a single
  OSSL_CMP_CTX object for the lifetime of a server process may observe
  unbounded memory growth in the event a malicious client repeatedly sends
  requests containing unique extra certificates, which may lead to OOM
  conditions.

  Reported by: Pavol Zacik (Red Hat).

  ([CVE-2026-63074])

  Neil Horman

• Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.

  Severity: Low

  Issue Summary: When OpenSSL processes QUIC traffic from a peer
  that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only
  responses, the QUIC stack can retain ACK-only packet metadata
  for the lifetime of the connection.

  Impact Summary: A remote peer that can complete a QUIC handshake can cause
  connection-scoped memory growth, which may lead to a Denial of Service
  through memory exhaustion, especially with sustained traffic or many
  concurrent QUIC connections.

  Reported by: Opal Wright (Trail of Bits).

  ([CVE-2026-63075])

  Neil Horman

• Fixed possibility of AEAD forgeries with empty ciphertext when using
  EVP_Cipher().

  Severity: Low

  Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty
  ciphertext can report success without verifying the supplied authentication
  tag when the operation is finalized by calling the EVP_Cipher() function.

  Impact summary: Applications calling EVP_Cipher() on an empty ciphertext
  and expecting the call to check the AEAD tag may accept forged messages.

  Reported by: Billy Brumley (Rochester Institute of Technology).

  ([CVE-2026-75803])

  Billy Bob Brumley

• Added OPENSSL_armcap(3) documentation page.

  Paul Elliott

• Added support for selecting assembly code paths for LLVM-based Intel's icx
  compiler.

  Wolfgang Beck

• Updated compliance with TLS 1.3 session ticket lifetime requirements.
  TLS 1.3 clients now cap ticket_lifetime_hint to 7 days (604800 seconds)
  when processing new session ticket messages, in accordance
  with [RFC 8446 Section 4.6.1].

  Abel Thomas

• Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
  in CCM cipher mode.

  Mounir IDRASSI

v4.0.0

Compare Source

• Fixed heap use-after-free in PKCS7_verify().

  Severity: High

  Issue summary: A specially crafted PKCS#7 or S/MIME signed message could
  trigger a use-after-free during PKCS#7 signature verification.

  Impact summary: A use-after-free may result in process crashes, heap
  corruption, or, potentially, remote code execution.

  Reported by: Thai Duong (Calif.io in collaboration with Claude
  and Anthropic Research).

  ([CVE-2026-45447])

  Igor Ustinov

• Fixed CMS AuthEnvelopedData processing may accept forged messages.

  Severity: Moderate

  Issue Summary: Cryptographic Message Services (CMS) processing fails
  to perform sufficient input validation on the cipher and tag length fields
  of AuthEnvelopedData containers, leading to various potential compromises.

  Impact Summary: Attackers making use of these vulnerabilities may achieve
  key-equivalent functionality for a given CMS recipient and/or bypass
  integrity validation for a given message.

  Reported by: Asim Viladi Oglu Manizada, Alex Gaynor (Anthropic),
  Ying Dong, and Haiyang Huang.

  ([CVE-2026-34182])

  Neil Horman

• Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.

  Severity: Moderate

  Issue summary: Remote peer may exhaust heap memory of the QUIC server
  or client by flooding it with packets containing PATH_CHALLENGE frames.

  Impact summary: A malicious remote peer can cause an unbounded memory
  allocation which can lead to an abnormal termination of the application
  acting as a QUIC client or server and a Denial of Service.

  Reported by: Abhinav Agarwal.

  ([CVE-2026-34183])

  Abhinav Agarwal and Alexandr Nedvedicky

• Fixed double-free when checking OCSP stapled response.

  Severity: Moderate

  Issue summary: A malicious server can exploit TLS OCSP stapling by delivering
  a crafted response through the status_request extension, triggering
  a double-free in the client's certificate verification path.

  Impact summary: Successful exploitation allows an attacker to corrupt heap
  memory via a double-free, potentially leading to a Denial of Service
  or possibly an attacker controlled code execution or other undefined
  behavior.

  Reported by: Wang Kenaz (University of Illinois),
  Guido Vranken (Aisle Research), and Aaron Grattafiori (Nvidia).

  ([CVE-2026-35188])

  Daniel Kubec

• Fixed NULL pointer dereference in QUIC server initial packet handling.

  Severity: Moderate

  Issue summary: Receiving a QUIC initial packet with an invalid token
  may trigger a NULL pointer dereference in the OpenSSL QUIC server
  with address validation disabled.

  Impact summary: NULL pointer dereference typically causes abnormal
  termination of the affected QUIC server process and a Denial of Service.

  Reported by: Sunwoo Lee (KENTECH), Hyuk Lim (KENTECH),
  and Seunghyun Yoon (KENTECH).

  ([CVE-2026-42764])

  Sunwoo Lee (KENTECH), Hyuk Lim (KENTECH), and Seunghyun Yoon (KENTECH)

• Fixed AES-OCB IV ignored on EVP_Cipher() path.

  Severity: Moderate

  Issue summary: When an application drives an AES-OCB context through
  the public EVP_Cipher() one-shot interface, the application-supplied
  initialisation vector (IV) is silently discarded.

  Impact summary: Every message encrypted under the same key uses the same
  effective nonce regardless of the IV supplied by the caller, resulting
  in (key, nonce) reuse and loss of confidentiality. If the same code path
  is used to compute the authentication tag, the tag depends only
  on the (key, IV) pair and not on the plaintext or ciphertext, allowing
  universal forgery of arbitrary ciphertext from a single captured message.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-45445])

  Viktor Dukhovni

• Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.

  Severity: Low

  Issue summary: A signed integer overflow when sizing the destination
  buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap
  buffer overflow.

  Impact summary: A heap buffer overflow may lead to a crash or possibly
  attacker controlled code execution or other undefined behaviour.

  Reported by: Zehua Qiao and Jinwen He.

  ([CVE-2026-7383])

  Viktor Dukhovni

• Fixed out-of-bounds read in CMS password-based decryption.

  Severity: Low

  Issue summary: When CMS password-based decryption ([RFC 3211]/PWRI key
  unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode
  KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

  Impact summary: A heap buffer over-read may trigger a crash, which leads
  to Denial of Service for an application if the input buffer ends at a memory
  page boundary and the following page is unmapped. There is no information
  disclosure, as the over-read bytes are not revealed to the attacker.

  Reported by: Bhabani Sankar Das and Haruki Oyama (Waseda University).

  ([CVE-2026-9076])

  Nikola Pajkovský

• Fixed heap buffer over-read in ASN.1 content parsing.

  Severity: Low

  Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive
  element whose content exceeds 2 gigabytes in length may cause a heap buffer
  over-read on 64-bit Unix and Unix-like platforms.

  Impact summary: The heap buffer over-read may crash the application (Denial
  of Service) or to load into the decoded ASN.1 object contents of memory
  beyond the end of the input buffer. More typically, such ASN.1 elements
  would instead be truncated.

  Reported by: Frank Buss.

  ([CVE-2026-34180])

  Viktor Dukhovni

• Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.

  Severity: Low

  Issue Summary: The PKCS#12 file processing fails to perform sufficient input
  validation for files that use Password-Based Message Authentication Code 1
  (PBMAC1) integrity mechanism allowing a certificate and private key forgery.

  Impact Summary: An attacker impersonating a user can cause a service reading
  PKCS#12 files to accept forged certificates and private keys with a 1 in 256
  probability.

  Reported by: Pavol Žáčik (Red Hat) and Alex Gaynor (Anthropic).

  ([CVE-2026-34181])

  Alicja Kario (Red Hat)

• Fixed NULL dereference in certificate verification with OCSP Checking.

  Severity: Low

  Issue summary: When a partial-chain certificate verification is enabled
  together with OCSP response checking for the whole chain, a NULL dereference
  will happen if the verified chain does not have a self-signed trusted anchor,
  crashing the process.

  Impact summary: A NULL pointer dereference can trigger a crash which leads
  to a Denial of Service for an application.

  Reported by: Joshua Rogers (Aisle Research).

  ([CVE-2026-42765])

  Joshua Rogers (Aisle Research) and Daniel Kubec

• Fixed possible NULL dereference in password-dased CMS decryption.

  Severity: Low

  Issue summary: A specially crafted password-encrypted CMS message
  could trigger a NULL pointer dereference during CMS decryption.

  Impact summary: This NULL pointer dereference could lead to an application
  crash and a Denial of Service.

  Reported by: Mayank Jangid, Kushal Khemka, Hari Priandana,
  Bhabani Sankar Das, and Qifan Zhang (Palo Alto Networks).

  ([CVE-2026-42766])

  Igor Ustinov

• Fixed NULL pointer dereference in CRMF EncryptedValue decryption.

  Severity: Low

  Issue summary: An attacker-controlled CMP (Certificate Management Protocol)
  server could trigger a NULL pointer dereference in a CMP client application.

  Impact summary: A NULL pointer dereference could cause a crash
  of the application and a Denial of Service.

  Reported by: Zhanpeng Liu (Tencent Xuanwu Lab),
  Guannan Wang (Tencent Xuanwu Lab), and Guancheng Li (Tencent Xuanwu Lab).

  ([CVE-2026-42767])

  Igor Ustinov

• Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
  and PKCS7_decrypt().

  Severity: Low

  Issue summary: The CMS_decrypt() and PKCS7_decrypt() functions
  are vulnerable to Bleichenbacher-style attack when an attacker is able
  to provide CMS or S/MIME messages and observe the error code
  and/or decryption output.

  Impact summary: The Bleichenbacher-style attack allows an attacker to use
  the victim's vulnerable application as a way to decrypt or sign messages
  with the victim's private RSA key.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-42768])

  Dmitry Belyavskiy (Red Hat) and Alicja Kario (Red Hat)

• Fixed trust anchor substitution via cert/issuer typo in CMP
  rootCaKeyUpdate.

  Severity: Low

  Issue Summary: An error in the callback used to verify the certificate
  provided in a Root CA key update Certificate Management Protocol (CMP)
  message response rendered the certificate validation ineffectual,
  which could lead to escalation of credentials from the Registration
  Authority (RA) level to the root Certification Authority (root CA) level.

  Impact Summary: The Registration Authority could replace the root CA
  certificate for the CMP clients with an arbitrary root CA certificate.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-42769])

  Alex Gaynor (Anthropic) and Bob Beck

• Fixed FFC-DH peer validation uses attacker-supplied q.

  Severity: Low

  Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)
  peer key, the peer key is not properly checked for the subgroup membership.

  Impact summary: A malicious peer which presents an X9.42 key carrying
  the victim's p and g parameters, a forged q = r (a small prime factor
  of the cofactor (p − 1)/q_local), and a public value Y of order r can
  recover the victim's private key after a small number of key exchange
  attempts.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-42770])

  Alex Gaynor (Anthropic), Viktor Dukhovni, and Norbert Pócs

• Fixed possible out of bounds read in X509_VERIFY_PARAM_set1_email().

  Severity: Low

  Issue summary: When X509_VERIFY_PARAM_set1_email() is called
  by an application to validate a crafted e-mail address, such as during
  S/MIME message validation, an out of bounds read can happen.

  Impact summary: This out of bounds read will not directly exfiltrate
  the data read to the attacker, so, the most likely result is a crash
  and a Denial of Service.

  Reported by: TrendAI Zero Day Initiative.

  ([CVE-2026-42771])

  Bob Beck

• Fixed incorrect tag processing for empty messages in AES-GCM-SIV
  and AES-SIV modes.

  Severity: Low

  Issue summary: The implementations of AES-SIV ([RFC 5297]) and AES-GCM-SIV
  ([RFC 8452]) mishandle the authentication of AAD (Additional Authenticated
  Data) with an empty ciphertext, allowing forgery of such messages.

  Impact summary: An attacker can forge empty messages with arbitrary AAD
  to the victim's application using these ciphers.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-45446])

  Dmitry Belyavskiy (Red Hat)

• Fixed excessive allocation of the handshake message buffer (aka HollowByte).

  Previously, we would allocate a buffer large enough to hold the full size of
  an incoming handshake message as advertised by the peer. This could be quite
  large (although it is bounded, e.g. for ClientHello this is approximately
  128 KiB). If the peer then fails to send the full handshake message, then the
  endpoint is left waiting for the remainder of the message to arrive and the
  memory is still allocated (i.e. a Slowloris attack). To prevent this, we
  incrementally grow the buffer as we receive the data.

  This issue was reported by Okta Red Team.

  Matt Caswell

• Fixed a regression introduced in 4.0.0 that led to a openssl pkey
  command crash when it was invoked to encrypt a private key with password
  being provided interactively.

  Viktor Dukhovni

• Fixed a regression introduced in 4.0.0 that led to openssl s_client -adv
  command prematurely terminating a session when reading input of 16384 bytes
  in one read() call.

  Eugene Syromiatnikov

• Fixed TLS 1.3 server not sending NewSessionTicket message
  after ciphersuite mismatch.

  Daniel Kubec

• Implemented validation of the minimal length of PSK identity
  being of at least one byte long, as required per [RFC 8446].

  Matt Caswell

• Fixed usage of stale application buffer pointer by kTLS implementation
  after incomplete writes when SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER is set,
  that led to invalid memory reads and sending of incorrect data.

  Ilya Maximets

v3.6.5: OpenSSL 3.6.5

Compare Source

OpenSSL 3.6.5 is a security patch release. The most severe CVE fixed
in this release is High.

This release incorporates the following bug fixes and mitigations:

• Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
  (CVE-2026-84782)

• Fixed excessive memory allocation in relative CRLDP processing.
  (CVE-2026-35189)

• Fixed QUIC unvalidated amplification credit may be over-accounted.
  (CVE-2026-35191)

• Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
  (CVE-2026-42772)

• Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
  (CVE-2026-54872)

• Fixed QUIC STREAM fragment metadata DoS.
  (CVE-2026-54873)

• Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
  (CVE-2026-54875)

• Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake.
  (CVE-2026-72897)

• Fixed QUIC connection-level flow control was not enforced for streams.
  (CVE-2026-75804)

• Fixed a NULL pointer dereference in CMP client revocation response handling.
  (CVE-2026-75805)

• Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
  (CVE-2026-75806)

• Fixed a timing side-channel in SM2 signature generation.
  (CVE-2026-77696)

• Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack
  implementation.
  (CVE-2026-84784)

• Fixed a bug where EVP_DecryptFinal() incorrectly reported a stale success
  on AES-SIV authentication failure.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

🔵 Needs a closer look

The OpenSSL 3→4 upgrade needs image-level validation of Python/cryptography compatibility and Node.js FIPS provider loading, since legacy CI only builds images and runtime checks are unavailable here.

No open issues 🎉

What changed in this PR

Updates OpenSSL from 3.6.4 to 4.1.0 in both legacy Docker image definitions, keeping the Python-only and Python/Node.js builds aligned.

Changes:

• Sets OPENSSL_VERSION=4.1.0 in both Dockerfiles.
• Leaves Alpine and Python version pins unchanged.

File	Description
legacy/​Dockerfile_python_nodejs	Updates OpenSSL for the legacy Python/Node.js image.
legacy/​Dockerfile_python	Updates OpenSSL for the legacy Python-only image.

_{Review effort: Balanced}