Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *openssl* to *4.0.2* has Failed (devtool error).
Detailed error information: Running 'devtool upgrade' for recipe openssl failed. NOTE: Reconnecting to bitbake server... Loading cache...done. Loaded 0 entries from dependency cache. Parsing recipes...done. Parsing of 956 .bb files complete (0 cached, 956 parsed). 1986 targets, 40 skipped, 0 masked, 0 errors. Removing 1 recipes from the x86_64 sysroot...done. NOTE: Resolving any missing task queue dependencies Build Configuration: BB_VERSION = "2.19.0" BUILD_SYS = "x86_64-linux" NATIVELSBSTRING = "universal" TARGET_SYS = "x86_64-poky-linux" MACHINE = "qemux86-64" SDKMACHINE = "x86_64" DISTRO = "poky" DISTRO_VERSION = "6.0.99+snapshot-04eb86757307582e7ff422273b1217269b5b5bff" TUNE_FEATURES = "m64 x86-64-v3" meta = "tmp-auh-upgrades:04eb86757307582e7ff422273b1217269b5b5bff" meta-yocto-bsp meta-poky = "master:6ce984c0a3a68c2fdc3c32bc185b6729d09e7829" workspace = "<unknown>:<unknown>" Initialising tasks...NOTE: The /proc/pressure files can't be read. Continuing build without monitoring pressure Sstate summary: Wanted 10 Local 10 Mirrors 0 Missed 0 Current 20 (100% match, 100% complete) done. NOTE: Executing Tasks NOTE: Tasks Summary: Attempted 103 tasks of which 100 didn't need to be rerun and all succeeded. NOTE: Writing buildhistory NOTE: Writing buildhistory took: 1 seconds Loading cache...done. Loaded 0 entries from dependency cache. Parsing recipes...done. Parsing of 957 .bb files complete (0 cached, 957 parsed). 1987 targets, 40 skipped, 0 masked, 0 errors. NOTE: Resolving any missing task queue dependencies Build Configuration: BB_VERSION = "2.19.0" BUILD_SYS = "x86_64-linux" NATIVELSBSTRING = "universal" TARGET_SYS = "x86_64-poky-linux" MACHINE = "qemux86-64" SDKMACHINE = "x86_64" DISTRO = "poky" DISTRO_VERSION = "6.0.99+snapshot-04eb86757307582e7ff422273b1217269b5b5bff" TUNE_FEATURES = "m64 x86-64-v3" meta = "tmp-auh-upgrades:04eb86757307582e7ff422273b1217269b5b5bff" meta-yocto-bsp meta-poky = "master:6ce984c0a3a68c2fdc3c32bc185b6729d09e7829" workspace = "<unknown>:<unknown>" Initialising tasks...NOTE: The /proc/pressure files can't be read. Continuing build without monitoring pressure Sstate summary: Wanted 1 Local 0 Mirrors 0 Missed 1 Current 0 (0% match, 0% complete) done. NOTE: Executing Tasks NOTE: Tasks Summary: Attempted 3 tasks of which 0 didn't need to be rerun and all succeeded. NOTE: Writing buildhistory NOTE: Writing buildhistory took: 1 seconds Adding changed files: 0% | | ETA: --:--:-- Adding changed files: 0% | | ETA: --:--:-- Adding changed files: 4% |# | ETA: 0:00:02 Adding changed files: 8% |## | ETA: 0:00:01 Adding changed files: 12% |#### | ETA: 0:00:01 Adding changed files: 16% |##### | ETA: 0:00:01 Adding changed files: 20% |####### | ETA: 0:00:01 Adding changed files: 24% |######## | ETA: 0:00:01 Adding changed files: 28% |########## | ETA: 0:00:01 Adding changed files: 32% |########### | ETA: 0:00:01 Adding changed files: 36% |############# | ETA: 0:00:01 Adding changed files: 40% |############## | ETA: 0:00:01 Adding changed files: 44% |################ | ETA: 0:00:01 Adding changed files: 48% |################# | ETA: 0:00:00 Adding changed files: 52% |################### | ETA: 0:00:00 Adding changed files: 56% |#################### | ETA: 0:00:00 Adding changed files: 61% |##################### | ETA: 0:00:00 Adding changed files: 65% |####################### | ETA: 0:00:00 Adding changed files: 69% |######################## | ETA: 0:00:00 Adding changed files: 73% |########################## | ETA: 0:00:00 Adding changed files: 77% |########################### | ETA: 0:00:00 Adding changed files: 81% |############################# | ETA: 0:00:00 Adding changed files: 85% |############################## | ETA: 0:00:00 Adding changed files: 89% |################################ | ETA: 0:00:00 Adding changed files: 93% |################################# | ETA: 0:00:00 Adding changed files: 97% |################################### | ETA: 0:00:00 Adding changed files: 100% |####################################| Time: 0:00:02 INFO: Extracting current version source... INFO: SRC_URI contains some conditional appends/prepends - will create branches to represent these INFO: Extracting upgraded version source... INFO: Fetching http://www.openssl.org/source/openssl-4.0.2.tar.gz... INFO: Rebasing devtool onto d6ba07602ea3cd9b4724788d53e51b4da4820b2f WARNING: Command 'git rebase d6ba07602ea3cd9b4724788d53e51b4da4820b2f' failed: Auto-merging test/helpers/handshake.c CONFLICT (content): Merge conflict in test/helpers/handshake.c You will need to resolve conflicts in order to complete the upgrade. INFO: Rebasing devtool-override-class-nativesdk onto d6ba07602ea3cd9b4724788d53e51b4da4820b2f WARNING: Command 'git rebase d6ba07602ea3cd9b4724788d53e51b4da4820b2f' failed: Auto-merging test/helpers/handshake.c CONFLICT (content): Merge conflict in test/helpers/handshake.c You will need to resolve conflicts in order to complete the upgrade. INFO: Upgraded source extracted to /srv/pokybuild/yocto-worker/auh/build/build/workspace/sources/openssl INFO: New recipe is /srv/pokybuild/yocto-worker/auh/build/build/workspace/recipes/openssl/openssl_4.0.2.bb INFO: Changelog extracted to /srv/pokybuild/yocto-worker/auh/build/build/workspace/changelogs/openssl.txt Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper
Changelog for openssl: 3.5.7 -> 4.0.2 Source: CHANGES.md - [OpenSSL 4.0](#openssl-40) - [OpenSSL 3.6](#openssl-36) OpenSSL 4.0 ### Changes between 4.0.1 and 4.0.2 [25 Aug 2026] * Fixed QUIC server being able to trigger double free when processing `INITIAL` packet. Severity: Moderate Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to a Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle, and Feng Xue (ThreatBoon). ([CVE-2026-18798]) *Alexandr Nedvědický* * Fixed heap buffer overflow in CMS key unwrapping. Severity: Moderate Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with `CMS_decrypt()`, corrupting the heap and typically resulting in a Denial of Service. Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits). ([CVE-2026-63072]) *Daniel Kubec* * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`. Severity: Moderate Issue Summary: The OpenSSL Certificate Management Protocol (CMP) password-based protection verification only checks whether the `protectionAlg` parameter was not NULL and not its ASN.1 type, before treating it as a `PBMParameter`. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. Reported by: Ying Dong and Bhabani Sankar Das. ([CVE-2026-63076]) *Daniel Kubec* * Fixed unbounded memory growth in QUIC server incoming channel queue. Severity: Low Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many `INITIAL` packets reach the server listener faster than the application accepts connections can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing a Denial of Service. Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI. ([CVE-2026-14456]) <!-- https://github.com/openssl/openssl/pull/32052 --> *Filipe Casal* * Fixed RPK server signature algorithm selection being able to dereference a missing certificate. Severity: Low Issue summary: In a server or client configuration with [RFC 7250] Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted `signature_algorithms_cert` TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI. ([CVE-2026-14457]) *Viktor Dukhovni* * Fixed excessive memory use buffering DTLS records for a future epoch. Severity: Low Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. Reported by: Amazon Web Services. ([CVE-2026-54874]) *Matt Caswell* * Fixed client-side nemory leak in OCSP response checking. Severity: Low Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. Reported by: Bhabani Sankar Das and Zhenzhe Shao. ([CVE-2026-54876]) <!-- https://github.com/openssl/openssl/pull/31764 --> *Mounir IDRASSI* * Fixed untrusted Sender DN being used as a format string in CMP response validation. Severity: Low Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI, Brandon Luo, and TrendAI Zero Day Initiative. ([CVE-2026-63073]) *Filipe Casal* * Fixed CMP indefinite cache growth of `extraCerts`. Severity: Low Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (`extraCerts`) sent in a CMP message, but never expunges them (for instance, if they are invalid). If a server reuses an `OSSL_CMP_CTX` object frequently, this cache of `extraCerts` may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact Summary: Users utilizing a CMP server that reuses a single `OSSL_CMP_CTX` object for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. Reported by: Pavol Zacik (Red Hat). ([CVE-2026-63074]) *Neil Horman* * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. Severity: Low Issue Summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact Summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth, which may lead to a Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. Reported by: Opal Wright (Trail of Bits). ([CVE-2026-63075]) *Neil Horman* * Fixed possibility of AEAD forgeries with empty ciphertext when using `EVP_Cipher()`. Severity: Low Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the `EVP_Cipher()` function. Impact summary: Applications calling `EVP_Cipher()` on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. Reported by: Billy Brumley (Rochester Institute of Technology). ([CVE-2026-75803]) <!-- https://github.com/openssl/openssl/pull/32300 --> *Billy Bob Brumley* * Added `OPENSSL_armcap(3)` documentation page. <!-- https://github.com/openssl/openssl/pull/31749 --> *Paul Elliott* * Added support for selecting assembly code paths for LLVM-based Intel's `icx` compiler. <!-- https://github.com/openssl/openssl/pull/31572 --> *Wolfgang Beck* * Updated compliance with TLS 1.3 session ticket lifetime requirements. TLS 1.3 clients now cap `ticket_lifetime_hint` to 7 days (604800 seconds) when processing new session ticket messages, in accordance with [RFC 8446 Section 4.6.1]. <!-- https://github.com/openssl/openssl/pull/31174 --> *Abel Thomas* * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode. <!-- https://github.com/openssl/openssl/pull/32427 --> *Mounir IDRASSI* ### Changes between 4.0.0 and 4.0.1 [9 Jun 2026] * Fixed double-free when checking OCSP stapled response. Severity: Moderate Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the `status_request` extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior. Reported by: Wang Kenaz (University of Illinois), Guido Vranken (Aisle Research), and Aaron Grattafiori (Nvidia). ([CVE-2026-35188]) *Daniel Kubec* * Fixed NULL dereference in certificate verification with OCSP Checking. Severity: Low Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. Reported by: Joshua Rogers (Aisle Research). ([CVE-2026-42765]) *Joshua Rogers (Aisle Research) and Daniel Kubec* * Fixed possible out of bounds read in `X509_VERIFY_PARAM_set1_email()`. Severity: Low Issue summary: When `X509_VERIFY_PARAM_set1_email()` is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker, so, the most likely result is a crash and a Denial of Service. Reported by: TrendAI Zero Day Initiative. ([CVE-2026-42771]) *Bob Beck* * Fixed excessive allocation of the handshake message buffer (aka HollowByte). Previously, we would allocate a buffer large enough to hold the full size of an incoming handshake message as advertised by the peer. This could be quite large (although it is bounded, e.g. for ClientHello this is approximately 128 KiB). If the peer then fails to send the full handshake message, then the endpoint is left waiting for the remainder of the message to arrive and the memory is still allocated (i.e. a Slowloris attack). To prevent this, we incrementally grow the buffer as we receive the data. This issue was reported by Okta Red Team. <!-- https://github.com/openssl/openssl/pull/30792 --> *Matt Caswell* * Fixed a regression introduced in 4.0.0 that led to a `openssl pkey` command crash when it was invoked to encrypt a private key with password being provided interactively. <!-- https://github.com/openssl/openssl/pull/30904 --> *Viktor Dukhovni* * Fixed a regression introduced in 4.0.0 that led to `openssl s_client -adv` command prematurely terminating a session when reading input of 16384 bytes in one `read()` call. <!-- https://github.com/openssl/openssl/pull/31413 --> *Eugene Syromiatnikov* ### Changes between 3.6 and 4.0.0 [14 Apr 2026] * Added `-expected-rpks` option to the `openssl s_client` and `openssl s_server` commands. This makes it possible to specify one or more public keys expected from the remote peer that are then used to authenticate the connection. <!-- https://github.com/openssl/openssl/pull/30089 --> *Viktor Dukhovni* * Added `-hmac-env` and `-hmac-stdin` options to `openssl dgst` command. <!-- https://github.com/openssl/openssl/pull/28160 --> *Igor Ustinov* * Added LMS support for signature verification to `openssl pkeyutl` command. To enable this, LMS `SubjectPublicKeyInfo` encoder and decoders were added, and the LMS keymanager and signature code were updated. <!-- https://github.com/openssl/openssl/pull/29381 --> *Shane Lontis* * Added new `SSL_get0_sigalg()` and `SSL_get0_shared_sigalg()` functions to report the TLS signature algorithm name and codepoint for the peer advertised and shared algorithms respectively. These supersede the existing `SSL_get_sigalgs()` and `SSL_get_shared_sigalgs()` functions, which are only a good fit for TLS 1.2. The names reported are the IANA names, and are expected to consistently match the names expected in `SignatureAlgorithms` configuration settings, see `SSL_CONF_cmd(3)` for details. Previously reported names were not always directly usable for configurations, and were mostly OpenSSL-specific aliases that rarely matched the official IANA codepoint names. There is an associated change in how signature algorithms are reported by the `openssl s_client` and `openssl s_server` commands. They now use the new functions and report the IANA registered names of each signature scheme. Example new output: Signature Algorithms: mldsa65:mldsa87:mldsa44:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ed25519:ed448:ecdsa_brainpoolP256r1tls13_sha256:ecdsa_brainpoolP384r1tls13_sha384:ecdsa_brainpoolP512r1tls13_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512:ecdsa_sha224:rsa_pkcs1_sha224:dsa_sha224:dsa_sha256:dsa_sha384:dsa_sha512 <!-- https://github.com/openssl/openssl/pull/29982 --> *Viktor Dukhovni* * Implemented client-side predicted keyshare floating. When a tuple loses the last element that was tagged for transmission of a predicted client keyshare (by default `*X25519MLKEM768` and `*X25519` in their respective tuples), either because the group is not enabled at compile-time, or because it is removed by configuration (e.g. `DEFAULT:-<groupname>`), if the tuple remains non-empty, the keyshare is inherited by the first (i.e. most preferred) remaining element of the tuple. <!-- https://github.com/openssl/openssl/pull/30113 --> *Viktor Dukhovni* * Implemented `OSSL_STORE` support for `EVP_SKEY` objects, that includes addition of new `-skeyuri` and `-storepass` options to `openssl enc` command, addition of a new `-skeys` option to `openssl storeutl` command, addition of `OSSL_STORE_INFO_SKEY` `OSS_STORE` object type and the relevant `OSSL_STORE_INFO_get0_SKEY()`, `OSSL_STORE_INFO_get1_SKEY()`, and `OSSL_STORE_INFO_new_SKEY()` APIs. <!-- https://github.com/openssl/openssl/pull/28278 --> *Dmitry Belyavskiy* * Added support for [RFC 8998], signature algorithm `sm2sig_sm3`, key exchange group `curveSM2`, and [tls-hybrid-sm2-mlkem] post-quantum group `curveSM2MLKEM768`. Verification of SM2-signed certificates required changing the default *distinguishing identifier* from empty to the constant ASCII string "1234567812345678". An explicit empty distinguishing identifier value may need to be used to verify or create signatures that are compatible with versions of OpenSSL prior to 4.0. With the command-line tools an empty value can be specified with the use of either the **-pkeyopt** (`openssl-pkeyutl(1)`) or **-sigopt** (`openssl-dgst(1)`) option with a value of "distid:". <!-- https://github.com/openssl/openssl/pull/29953 --> *Viktor Dukhovni* * Added support for TLS 1.3 SM cipher suites `TLS_SM4_GCM_SM3` and `TLS_SM4_CCM_SM3` from [RFC 8998]. <!-- https://github.com/openssl/openssl/pull/30028 --> *Milan Brož* * Added cSHAKE function support as per [SP 800-185]. <!-- https://github.com/openssl/openssl/pull/28432 --> *Shane Lontis* * Added "ML-DSA-MU" digest algorithm support. <!-- https://github.com/openssl/openssl/pull/29223 --> *Shane Lontis* * Added SNMP KDF (`EVP_KDF_SNMPKDF`) to `EVP_KDF`. <!-- https://github.com/openssl/openssl/pull/29195 --> *Barry Fussell and Helen Zhang* * Added SRTP KDF (`EVP_KDF_SRTPKDF`) to `EVP_KDF`. <!-- https://github.com/openssl/openssl/pull/29435 --> *Barry Fussell and Helen Zhang* * Implemented [RFC 7919], adding support for negotiated FFDHE key exchange in TLS 1.2. <!-- https://github.com/openssl/openssl/pull/24551 --> *Joachim Vandersmissen* (with additional support from *Viktor Dukhovni*) * Added AKID verification checks when `X509_V_FLAG_X509_STRICT` is set. Raise `X509_V_ERR_MISSING_AUTHORITY_KEY_IDENTIFIER` when AKID is not present. Raise `X509_V_ERR_EMPTY_AUTHORITY_KEY_IDENTIFIER` when AKID has no attributes. Raise `X509_V_ERR_AKID_ISSUER_SERIAL_NOT_PAIRED` when `authorityCertIssuer` and `authorityCertSerialNumber` fields are not paired. <!-- https://github.com/openssl/openssl/pull/29971 --> *Daniel Kubec* * Implemented [RFC 9849], adding support for Encrypted Client Hello (ECH). See `doc/design/ech-api.md` for details. <!-- https://github.com/openssl/openssl/pull/25193 --> <!-- https://github.com/openssl/openssl/pull/25420 --> <!-- https://github.com/openssl/openssl/pull/25663 --> <!-- https://github.com/openssl/openssl/pull/26011 --> <!-- https://github.com/openssl/openssl/pull/27540 --> <!-- https://github.com/openssl/openssl/pull/27561 --> <!-- https://github.com/openssl/openssl/pull/28270 --> <!-- https://github.com/openssl/openssl/pull/29200 --> <!-- https://github.com/openssl/openssl/pull/30048 --> *Stephen Farrell* (with much support from *Matt Caswell* and *Tomáš Mráz*) * Implemented display of CPU capabilities in `openssl version -c` output on POWER and SPARC platforms, added `OPENSSL_ppccap(3)` manual page. <!-- https://github.com/openssl/openssl/pull/28535 --> <!-- https://github.com/openssl/openssl/pull/29116 --> <!-- https://github.com/openssl/openssl/pull/29230 --> *Bernd Edlinger, Nia Alarie, and George Wilson* * Added `OSSL_ESS_check_signing_certs_ex()` function. This API call is an extension to `OSSL_ESS_check_signing_certs()` that adds the ability to specify a library context and property query when fetching algorithms to validate a given certificate. <!-- https://github.com/openssl/openssl/pull/30034 --> *Neil Horman* * Added `OPENSSL_sk_set_cmp_thunks()` function to allow for proper typecasting during comparison of elements in a `STACK_OF` structure. <!-- https://github.com/openssl/openssl/pull/29640 --> *Neil Horman* * Added `OSSL_PARAM_clear_free` function that allows cleansing `PARAM`s that contain sensitive information, and switched to its use where it is suitable. <!-- https://github.com/openssl/openssl/pull/28108 --> *Simo Source* * Added `ASN1_BIT_STRING_get_length()` function, that returns the number of octets and the number of unused bits in an `ASN1_BIT_STRING` object. <!-- https://github.com/openssl/openssl/pull/29387 --> *Bob Beck* * Added `ASN1_BIT_STRING_set1()` function to set a bit string to a value, including the length in bytes and the number of unused bits. Internally, `ASN1_BIT_STRING_set_bit()` has also been modified to keep the number of unused bits correct when changing an `ASN1_BIT_STRING`. <!-- https://github.com/openssl/openssl/pull/29926 --> *Bob Beck* * Added `PACKET_msg_start()` function, that allows obtaining start of a `PACKET` buffer. <!-- https://github.com/openssl/openssl/pull/27776 --> *Matt Caswell* * Added `SSL_add1_dnsname()`, `SSL_set1_dnsname()`, `SSL_add1_ipaddr()`, and `SSL_set1_ipaddr()` functions as a replacement for `SSL_add1_host()` and `SSL_set1_host()` that are deprecated now. The new replacement API functions was added to support checking multiple names against a certificate with `X509_VERIFY_PARAM`. See `X509_VERIFY_PARAM_set_flags(3)` for full details. <!-- https://github.com/openssl/openssl/pull/29612 --> *Bob Beck* * Added `SSL_listen_ex()` function, that, together with added ability to create "blank" SSL objects using `OSSL_QUIC_method()`, allows implementing polling of inbound connections in QUIC in a fashion similar to DTLS. <!-- https://github.com/openssl/openssl/pull/27397 --> *Neil Horman* * Added `SSL_CTX_get0_alpn_protos()` and `SSL_get0_alpn_protos()` functions. <!-- https://github.com/openssl/openssl/pull/29646 --> *Daniel Kubec* * Added `SSL_CTX_is_server()` function, that is similar to `SSL_is_server()`, but takes `SSL_CTX` object as an argument. <!-- https://github.com/openssl/openssl/pull/29635 --> *Igor Ustinov* * Added `EVP_MD_CTX_serialize()`/`EVP_MD_CTX_deserialize()` functions. These functions allow to export the internal state of a Digest and re-import it later to continue a computation from a specific checkpoint. Only SHA-2 and the SHA-3 family (Keccak, SHAKE, SHA-3) of functions currently support this functionality. <!-- https://github.com/openssl/openssl/pull/28837 --> *Simo Sorce* * Added `BIO_set_send_flags()` function that allows setting flags passed to `send()`, `sendto()`, and `sendmsg()`. The main intention is to allow setting the `MSG_NOSIGNAL` flag to avoid a crash on receiving the `SIGPIPE` signal. <!-- https://github.com/openssl/openssl/pull/30044 --> *Igor Ustinov* * Added `X509v3_delete_extension()` function, that extends `X509v3_delete_ext()` by deallocating the extension stack if it becomes empty, as a convenience wrapper useful for optional X.509 extensions. <!-- https://github.com/openssl/openssl/pull/30252 --> *Viktor Dukhovni* * Added ability to specify ML-KEM and ML-DSA encoding formats on a per-key basis, by setting `output-formats` `EVP_PKEY` encoding parameter appropriately via `OSSL_ENCODER_CTX_set_params(3)`. <!-- https://github.com/openssl/openssl/pull/29206 --> *Viktor Dukhovni* * Added documentation for `BIO` flags and related functions. <!-- https://github.com/openssl/openssl/pull/29311 --> *Igor Ustinov* * FIPS self tests can now be deferred and run as needed when installing the FIPS module with the `-defer_tests` option of the `openssl fipsinstall` command. <!-- https://github.com/openssl/openssl/pull/29222 --> *Simo Sorce* * Lower bounds checks are now enforced when using `PKCS5_PBKDF2_HMAC` API with FIPS provider. When using the FIPS provider via the `PKCS5_PBKDF2_HMAC` API, password protected encrypted files will now have lower bounds checks (minimum iteration count, minimum password length, salt size and derived key lengths) enforced by default. Prior to upgrading to this version, users may want to check if their password protected key–stores are encrypted using short passwords, salts, low iteration counts for PBKDF or weaker ciphers. To upgrade to the new defaults one can decrypt the keys with a previous OpenSSL version or the default provider, and then re-encrypt them with the newer OpenSSL (using the FIPS provider), thus upgrading to longer password, salt length and AES-256 CBC. <!-- https://github.com/openssl/openssl/pull/27431 --> *Dimitri John Ledkov* * Added support for using either static or dynamic VC runtime linkage on Windows. Using the `enable-static-vcruntime` configuration option, OpenSSL can now be configured to use the static or dynamic `vcruntime.dll` linkage. The multithreaded or single threaded static VC runtime is selected based on the `enable-threads` option. <!-- https://github.com/openssl/openssl/pull/29995 --> *Neil Horman* * Added configure options to disable KDF algorithms for `hmac-drbg-kdf`, `kbkdf`, `krb5kdf`, `pvkkdf`, `snmpkdf`, `sskdf`, `sshkdf`, `x942kdf`, and `x963kdf`. <!-- https://github.com/openssl/openssl/pull/29576 --> *Shane Lontis* * Removed configure options can now only be disabled. You may continue to use `disable-<feature>` syntax, which will remain supported. Using `enable-<feature>` for a removed feature is no longer permitted. <!-- https://github.com/openssl/openssl/pull/29338 --> *Andrew Dinh* * Added restrictions on the maximum number of TLS `key_share`s (16) that a server will pay attention to, as well as the maximum number of supported `group`s (128) and `sig_alg`s (128). Any sent beyond these limits are ignored, in order to avoid clients sending excessively long lists in these extensions. <!-- https://github.com/openssl/openssl/pull/30263 --> *Matt Caswell* * Removed specialised built-in logic for adding the SKID and AKID extensions from `openssl x509`, `openssl req`, and `openssl ca` commands, these extensions are handled through configuration files and command-line options just like any other extension. See their documentation and also `x509v3_config(5)` for additional details. Updated the syntax of the `subjectKeyIdentifier` (SKID) and `authorityKeyIdentifier` (AKID) extensions, introducing the `nonss` qualifier for the `keyid` and `issuer` keywords. The x509 "mini-CA" now attempts to find extension settings in the default configuration file even if neither the `-extfile` nor the `-extensions` option is explicitly specified. Failure to open the default configuration is silently ignored. The settings in the stock OpenSSL 4.0 configuration file arrange for addition of the requisite SKID and AKID extensions. Other configuration files may need to be adjusted if desired. <!-- https://github.com/openssl/openssl/pull/29057 --> *Viktor Dukhovni* * Enabled Server verification by default in `s_server` when the `-verify_return_error` option is enabled. <!-- https://github.com/openssl/openssl/pull/28445 --> *Ryan Hooper* * Removed extra leading '00:' when printing key data such as an RSA modulus in hexadecimal format where the first (most significant) byte is >= 0x80. This had been added artificially to resemble ASN.1 DER encoding internals. Fixing this also makes sure that key output always has the expected length. <!-- https://github.com/openssl/openssl/pull/8136 --> *David von Oheimb* * Standardized the width of hexadecimal dumps to 24 bytes for signatures (to stay within the 80 characters limit) and 16 bytes for everything else. <!-- https://github.com/openssl/openssl/pull/29266 --> *Beat Bolli* * Updated the default group list to append `SecP256r1MKEM768` and `curveSM2MLKEM768` to the first tuple in that order after `*X25519MLKEM768`. Also inserted a penultimate tuple with `curveSM2` (just before the `FFDHE` groups). <!-- https://github.com/openssl/openssl/pull/30113 --> *Viktor Dukhovni* * Consolidated processing of SM2 and EdDSA signatures with essentially identical code for ECDSA in the `openssl speed` command. The output format has changed slightly to report the EC curve name rather than its bit size. <!-- https://github.com/openssl/openssl/pull/29953 --> *Viktor Dukhovni* * CRLs with a malformed Issuing Distribution Point extensions are now rejected. <!-- https://github.com/openssl/openssl/pull/30171 --> *Daniel Kubec* * CRLs with malformed `CRL Number` or `Delta CRL Indicator` extensions are now rejected. <!-- https://github.com/openssl/openssl/pull/30024 --> *Daniel Kubec* * Fixed CRLs with invalid `ASN1_TIME` in `invalidityDate` extensions, where verification incorrectly succeeded. Enforced proper handling of `ASN1_TIME` validation results so that any CRL containing invalid time fields is rejected immediately, preventing the error from propagating to verification. <!-- https://github.com/openssl/openssl/pull/29107 --> *Daniel Kubec* * CRLs with a `Certificate Issuer` extension in a certificate revocation entry are now rejected, unless the `Indirect` flag is set to `TRUE` in the `Issuing Distribution Point` extension of the CRL. <!-- https://github.com/openssl/openssl/pull/29018 --> *Daniel Kubec* * `SSL_get_error()` no longer depends on the state of the error stack, so it is no longer necessary to empty the error queue before the TLS/SSL I/O operations. <!-- https://github.com/openssl/openssl/pull/29991 --> *Igor Ustinov* * `ASN1_STRING` has been made opaque. Access to values from `ASN1_STRING` and related types should be done with the appropriate accessor functions. The various `ASN1_STRING_FLAG` values have been made private. <!-- https://github.com/openssl/openssl/pull/29862 --> *Bob Beck* * `OPENSSL_cleanup()` now runs in a global destructor, or not at all by default: `OPENSSL_cleanup()` will no longer by default free global objects when run from an application. Instead it sets a flag for a global destructor to do this after the process exits, and after subordinate libraries using OpenSSL have run their destructors. If destructor support is not available, `OPENSSL_cleanup()` will do nothing, leaving the global objects to be cleaned up by the operating system. <!-- https://github.com/openssl/openssl/pull/29721 --> *Bob Beck* * `X509_ALGOR_set_md()` function now returns a value indicating success or failure. <!-- https://github.com/openssl/openssl/pull/17495 --> *David von Oheimb* * Changed `BIO_snprintf()` implementation to use `snprintf()` provided by system's libc (instead of relying on internal implementation), making it bug-for-bug compatible with it. <!-- https://github.com/openssl/openssl/pull/28305 --> *Alexandr Nedvedicky* * Added `X509_check_certificate_times()` function, as well as the `<openssl/posix_time.h>` interface from BoringSSL/LibreSSL, that replace now deprecated `X509_cmp_time()`, `X509_cmp_current_time()`, and `X509_cmp_timeframe()`. See `X509_check_certificate_times(3)` for details. <!-- https://github.com/openssl/openssl/pull/28623 --> <!-- https://github.com/openssl/openssl/pull/29152 --> <!-- https://github.com/openssl/openssl/pull/30098 --> *Bob Beck* * `const`-corrected `time_t` arguments for `X509_cmp_time()`, `X509_time_adj()`, and `X509_time_adj_ex()`. <!-- https://github.com/openssl/openssl/pull/30020 --> *Frederik Wedel-Heinen* * Made `X509_ATTRIBUTE` accessor functions `const`-correct. The functions `X509_ATTRIBUTE_get0_object()`, `X509_ATTRIBUTE_get0_type()`, and `X509_ATTRIBUTE_get0_data()` now accept `const X509_ATTRIBUTE *` and return `const` pointers. Related PKCS#12 functions `PKCS12_get_attr_gen()`, `PKCS12_get_attr()`, and `PKCS8_get_attr()` have also been updated to return `const ASN1_TYPE *`. <!-- https://github.com/openssl/openssl/pull/29813 --> *kovan* * Made `X509_PUBKEY` accessor functions `const`-correct. <!-- https://github.com/openssl/openssl/pull/29428 --> *Bob Beck* * `const`-corrected various function return values, particularly in `X509` and related areas, and when functions were returning non-`const` objects owned by a `const` parameter. <!-- https://github.com/openssl/openssl/pull/30035 --> <!-- https://github.com/openssl/openssl/pull/30036 --> *Bob Beck* * Many functions accepting `X509 *` arguments, or returning values from a `const` `X509 *` have been changed to take/return `const` arguments. The most visible changes are places where pointer values are returned from a `const` `X509 *` object. In many places where these were non `const` values being returned from a `const` object, these pointer values have now been made `const`. The goal of this change is to enable future improvements in X.509 certificate handling. For full details see the relevant section in `ossl-migration-guide(7)`. <!-- https://github.com/openssl/openssl/pull/29465 --> <!-- https://github.com/openssl/openssl/pull/29468 --> <!-- https://github.com/openssl/openssl/pull/29488 --> <!-- https://github.com/openssl/openssl/pull/30053 --> <!-- https://github.com/openssl/openssl/pull/30054 --> <!-- https://github.com/openssl/openssl/pull/30056 --> <!-- https://github.com/openssl/openssl/pull/30058 --> <!-- https://github.com/openssl/openssl/pull/30067 --> <!-- https://github.com/openssl/openssl/pull/30071 --> <!-- https://github.com/openssl/openssl/pull/30072 --> <!-- https://github.com/openssl/openssl/pull/30073 --> <!-- https://github.com/openssl/openssl/pull/30074 --> <!-- https://github.com/openssl/openssl/pull/30076 --> <!-- https://github.com/openssl/openssl/pull/30079 --> <!-- https://github.com/openssl/openssl/pull/30080 --> <!-- https://github.com/openssl/openssl/pull/30082 --> <!-- https://github.com/openssl/openssl/pull/30084 --> <!-- https://github.com/openssl/openssl/pull/30090 --> <!-- https://github.com/openssl/openssl/pull/30092 --> <!-- https://github.com/openssl/openssl/pull/30096 --> <!-- https://github.com/openssl/openssl/pull/30117 --> <!-- https://github.com/openssl/openssl/pull/30127 --> <!-- https://github.com/openssl/openssl/pull/30229 --> <!-- https://github.com/openssl/openssl/pull/30235 --> <!-- https://github.com/openssl/openssl/pull/30265 --> <!-- https://github.com/openssl/openssl/pull/30272 --> <!-- https://github.com/openssl/openssl/pull/30273 --> <!-- https://github.com/openssl/openssl/pull/30276 --> *Bob Beck* * `const`-corrected various function parameters, in particular for `X509`-related functions. <!-- https://github.com/openssl/openssl/pull/28033 --> *David von Oheimb* * `const`-corrected various `X509`-related functions: `X509_get_pathlen()`, `X509_check_ca()`, `X509_check_purpose()`, `X509_get_proxy_pathlen()`, `X509_get_extension_flags()`, `X509_get_key_usage()`, `X509_get_extended_key_usage()`, `X509_get0_subject_key_id()`, `X509_get0_authority_key_id()`, `X509_get0_authority_issuer()`, `X509_get0_authority_serial()`, `X509_get0_distinguishing_id()`. <!-- https://github.com/openssl/openssl/pull/30055 --> *Bob Beck* * Removed needless `const` qualifiers from scalar type arguments in the public APIs, mostly for AES and Camellia. <!-- https://github.com/openssl/openssl/pull/18229 --> *David von Oheimb* * Fixed a bug that allowed TLS 1.2 ciphers to be added to the TLS 1.3 `ciphersuites` list, and for that list to contain duplicates. Cipher configuration strings for both TLS 1.2 and 1.3 are now case-insensitive. <!-- https://github.com/openssl/openssl/pull/30140 --> *Viktor Dukhovni* * Deprecated `ASN1_OBJECT_new()` function. Refer to `ossl-migration-guide(7)` for more info. <!-- https://github.com/openssl/openssl/pull/30011 --> *Frederik Wedel-Heinen* * Deprecated `X509_NAME_get_text_by_NID()` and `X509_NAME_get_text_by_OBJ()` functions, and documented them as such. <!-- https://github.com/openssl/openssl/pull/30031 --> *Bob Beck* * Removed the `SSL_TXT_FIPS` option. This was a remnant of the old FIPS canister and wasn't used anymore. <!-- https://github.com/openssl/openssl/pull/30200 --> *Dr Paul Dale* * Removed `OPENSSL_atexit()` function. <!-- https://github.com/openssl/openssl/pull/29874 --> *Bob Beck* * Removed critical extension enforcement for `EXFLAG_BCONS_CRITICAL`, `EXFLAG_AKID_CRITICAL`, `EXFLAG_SKID_CRITICAL`, and `EXFLAG_SAN_CRITICAL`, as it was incorrect. These checks were intended as CA requirements to prevent misinterpretation by verifiers that don't support certain extensions. However, since we do support these extensions, there is no requirement for them to be marked as critical. Enforcing that on `X509_V_FLAG_X509_STRICT` was a mistake. <!-- https://github.com/openssl/openssl/pull/30249 --> *Daniel Kubec* * Removed support for an SSLv2 Client Hello. When a client wanted to support both SSLv2 and higher versions like SSLv3 or even TLSv1, it needed to send an SSLv2 Client Hello. SSLv2 support itself was removed in OpenSSL 1.1.0, but there was still compatibility code for clients sending an SSLv2 Client Hello. Since we no longer support SSLv2 Client Hello, `SSL_client_hello_isv2()` is now deprecated and always returns 0. <!-- https://github.com/openssl/openssl/pull/28041 --> *Kurt Roeckx* * Removed support for SSLv3. SSLv3 has been deprecated since 2015, and OpenSSL had it disabled by default since version 1.1.0 (2016). <!-- https://github.com/openssl/openssl/pull/29338 --> *Kurt Roeckx* * Support of deprecated elliptic curves in TLS according to [RFC 8422] was disabled at compile-time by default. To enable it, use the `enable-tls-deprecated-ec` configuration option. <!-- https://github.com/openssl/openssl/pull/29658 --> *Dmitry Belyavskiy* * Support of explicit EC curves was disabled by default, an error will occur if an explicit EC curve doesn't match any known one. A new configuration option, `enable-ec_explicit_curves`, is added. <!-- https://github.com/openssl/openssl/pull/29639 --> *Dmitry Belyavskiy* * Removed `c_rehash` script tool. Use `openssl rehash` instead. <!-- https://github.com/openssl/openssl/pull/29427 --> *Norbert Pócs* * `libcrypto` no longer cleans up globally allocated data via `atexit()`. This data is cleaned up automatically by the OS. Some memory leak detectors may report spurious allocated and reachable memory at application exit. To avoid such spurious leak detection reports the application may call `OPENSSL_cleanup()` before the process exits. <!-- https://github.com/openssl/openssl/pull/29385 --> *Alexandr Nedvedicky* * Removed the `crypto-mdebug-backtrace` configuration option entirely. The option has been a no-op since OpenSSL 1.0.2. <!-- https://github.com/openssl/openssl/pull/29380 --> *Neil Horman* * Removed the deprecated function `ASN1_STRING_data()`. <!-- https://github.com/openssl/openssl/pull/29149 --> *Bob Beck* * Removed the `ASN1_STRING_FLAG_X509_TIME` define. <!-- https://github.com/openssl/openssl/pull/29187 --> *Bob Beck* * Dropped `darwin-i386{,-cc}` and `darwin-ppc{,64}{,-cc}` targets from Configurations. <!-- https://github.com/openssl/openssl/pull/29653 --> <!-- https://github.com/openssl/openssl/pull/29672 --> *Daniel Kubec and Eugene Syromiatnikov* * Removed support for engines. The `no-engine` build option and the `OPENSSL_NO_ENGINE` macro are always present. Applications that use `ENGINE_` functions without `OPENSSL_NO_ENGINE` guards can be built by defining a macro `OPENSSL_ENGINE_STUBS`; however, all these functions will return error when called. Provider API should be used to replace engine functionality. <!-- https://github.com/openssl/openssl/pull/29305 --> *Milan Brož*, *Neil Horman*, *Norbert Pócs* * Removed deprecated support for custom `EVP_CIPHER`, `EVP_MD`, `EVP_PKEY`, and `EVP_PKEY_ASN1` methods (`EVP_CIPHER_meth_*`, `EVP_MD_meth_*`, `EVP_PKEY_meth_*`, and `EVP_PKEY_asn1_*` function families, respectively). <!-- https://github.com/openssl/openssl/pull/29299 --> <!-- https://github.com/openssl/openssl/pull/29366 --> <!-- https://github.com/openssl/openssl/pull/29384 --> <!-- https://github.com/openssl/openssl/pull/29405 --> <!-- https://github.com/openssl/openssl/pull/29446 --> *Matt Caswell* * Removed deprecated fixed SSL/TLS version methods (`{SSLv3,{D,}TLSv1{,_1,_2}}{,_client,_server}_method()` functions), the migrating application should use `TLS_method()`, `TLS_client_method()`, and `TLS_server_method()` functions instead. <!-- https://github.com/openssl/openssl/pull/30128 --> *Frederik Wedel-Heinen* * Removed `BIO_f_reliable()` implementation without replacement. It was broken since 3.0 release without any complaints. <!-- https://github.com/openssl/openssl/pull/29445 --> *Tomáš Mráz* * Removed deprecated functions `ERR_get_state()`, `ERR_remove_state()` and `ERR_remove_thread_state()`, as well as the `ERR_FLAG_MARK`, `ERR_FLAG_CLEAR` and `ERR_NUM_ERRORS` macros. The `ERR_STATE` object is now always opaque. <!-- https://github.com/openssl/openssl/pull/30005 --> *Tomáš Mráz* * Removed the deprecated `msie-hack` option from the `openssl ca` command. <!-- https://github.com/openssl/openssl/pull/30033 --> *Bob Beck* OpenSSL 3.6 ----------- ### Changes between 3.6.1 and 3.6.2 [7 Apr 2026] * Fixed out-of-bounds read in AES-CFB-128 on x86-64 CPUs with AVX-512 support. Severity: Low Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not written to output. Reported by: Stanislav Fort (Aisle Research), Pavel Kohout (Aisle Research), and Alex Gaynor (Anthropic). ([CVE-2026-28386]) *Stanislav Fort, Pavel Kohout, and Alex Gaynor* * Fixed performance regressions introduced in 3.6 caused by the lack of usage of CPU-capability-specific optimisations with non-EVP APIs, as the capability detection was no longer performed during library load. <!-- https://github.com/openssl/openssl/pull/30557 --> *Bob Beck* ### Changes between 3.6.0 and 3.6.1 [27 Jan 2026] * Fixed a regression in `X509_V_FLAG_CRL_CHECK_ALL` flag handling by restoring its pre-3.6.0 behaviour of being ignored when `X509_V_FLAG_CRL_CHECK` flag is not set, and no longer implying the latter flag instead. <!-- https://github.com/openssl/openssl/pull/28797 --> *Carter Thaxton* * Fixed a regression that caused generation of empty stapled OCSP responses when at least one certificate in the certificate chain had a stapled OCSP response present, causing handshake failures for OpenSSL 3.6.0 servers with various client implementations, including GnuTLS and BoringSSL. <!-- https://github.com/openssl/openssl/pull/28955 --> *Martin Rauch* * Fixed exit code of `openssl x509` command with `-checkend` option in use. <!-- https://github.com/openssl/openssl/pull/29155 --> *Stefan Rieche* <!-- https://github.com/openssl/openssl/pull/29245 --> * Reverted a change in behaviour of the single stapled OCSP response API with respect to the ownership of the OCSP response object that caused a memory leak. <!-- https://github.com/openssl/openssl/pull/29251 --> *Remi Gacogne and Tomáš Mráz* ### Changes between 3.5 and 3.6.0 [1 Oct 2025] * Added support for `EVP_SKEY` opaque symmetric key objects to the key derivation and key exchange provider methods. Added `EVP_KDF_CTX_set_SKEY()`, `EVP_KDF_derive_SKEY()`, and `EVP_PKEY_derive_SKEY()` functions. *Dmitry Belyavskiy and Simo Sorce* * Added PCT for key import for SLH-DSA when in FIPS mode. *Dr Paul Dale* * Added `i2d_PKCS8PrivateKey(3)` API to complement `i2d_PrivateKey(3)`, the former always outputs PKCS#8. *Viktor Dukhovni* * Implemented interleaved AES-CBC+HMAC-SHA algorithm on AArch64. *Fangming Fang* * Added NIST security categories for PKEY objects. *Dr Paul Dale* * Added notification when all stream FINs are acknowledged in QUIC. Introduced `ossl_quic_channel_notify_flush_done()` so that once final FINs are ACKed, the channel transitions to terminating and `SSL_poll()` signals completion. This allows applications to progress shutdown reliably. *Alexandr Nedvědický* * Added array memory allocation routines and converted suitable memory allocation calls in the library to them. *Eugene Syromiatnikov* * Fixed behavior change of EC keygen by adding the generic error entry if the provider did not itself add an error entry onto the queue. That way, there always is an error on the error queue in case of a failure, but no behavior change in case the provider emitted the error entry itself. *Ingo Franzki* * Documented all the environment variables used across the project in `openssl-env(7)` and in specific man pages. *Eugene Syromiatnikov* * Added SHA-2 assembly implementation enhancing performance for LoongArch. Added optimized SM3, MD5, SHA-256, SHA-512 implementation using Zbb extension for RISC-V. *Julian Zhu* * Added options `CRYPTO_MEM_SEC` and `CRYPTO_MEM_SEC_MINSIZE` to `openssl` app to initialize secure memory at the beginning of `openssl` app. *Norbert Pócs* * Resolved compiler warnings on Win64 builds. *Tomáš Mráz* * Extended new `CRYPTO_THREAD_[get|set]_local` API to reduce the usage of OS thread-local variables. *Neil Horman* * Added `make` targets `build_inst_sw` and `build_inst_programs` which have the functionality to split the build into two parts, e.g. when tests should be built with different compiler flags than the installed software. *Pavol Zacik* * Refactored `OSSL_PARAM` name parsing so that automatically generated parsers are used instead of `OSSL_PARAM_locate()` calls. This should also ensure that the list of acceptable parameters better matches those which are actually processed. It should also provide a small performance improvement, because repeated iteration over passed parameter arrays is avoided. *Dr Paul Dale* * Introduced `SSL_OP_SERVER_PREFERENCE`, superseding misleadingly named `SSL_OP_CIPHER_SERVER_PREFERENCE`. *Michael Baentsch* * Added LMS signature verification support as per [SP 800-208]. This support is present in both the FIPS and default providers. *Shane Lontis and Paul Dale* * Introduced use of `<stdbool.h>` when handling JSON encoding in the OpenSSL codebase, replacing the previous use of `int` for these boolean values. *Alexis Goodfellow* * An ANSI-C toolchain is no longer sufficient for building OpenSSL. The code should be built using compilers supporting C-99 features. *Alexandr Nedvědický* * Support for the VxWorks platforms has been removed. These platforms were unadopted, unmaintained and reported to be non-functional. *Anthony Ioppolo* * Relaxed the path check in OpenSSL's `file:` scheme implementation for `OSSL_STORE`. Previously, when the `file:` scheme is an explicit part of the URI, our implementation required an absolute path, such as `file:/path/to/file.pem`. This requirement is now relaxed, allowing `file:path/to/file.pem`, as well as `file:file.pem`. *Richard Levitte* * Changed `openssl-pkey(1)` to match the documentation when private keys are output in DER format (`-outform DER`) by producing the PKCS#8 form by default. Previously, this would output the *traditional* form for those older key types (`DSA`, `RSA`, `ECDSA`) that had such a form. The `-traditional` flag has been extended to support explicit requests to output that format in DER format (it was previously PEM-only). *Viktor Dukhovni* * Added an `openssl configutl` utility for processing the OpenSSL configuration file and dumping the equal configuration file. *Dmitry Belyavskiy based on Clemens Lang's code* * Added support for setting a free function thunk to `OPENSSL_sk` stack types. Using a thunk allows the type specific free function to be called with the correct type information from generic functions like `OPENSSL_sk_pop_free()`. *Frederik Wedel-Heinen* * Enabled x86-64 SM4 optimizations with SM4 ISA Extension available starting Lunar Lake and Arrow Lake S CPUs. The expected performance improvement is ~3.6x for `sm4-cbc`, ~2.9x for `sm4-gcm`, ~9.2x for `sm4-xts`, ~5.3x for `sm4-ccm` (on average, may vary depending on the data size) on Arrow Lake S. *Alina Elizarova* * Enabled x86-64 SM3 optimizations with SM3 ISA Extension available starting Lunar Lake and Arrow Lake S CPUs. The expected performance improvement is ~2.2—4.7x (depends on the data size) on Arrow Lake S. *Alina Elizarova* * Enabled x86-64 SHA-512 optimizations with SHA512 ISA Extension. Optimized digests: `sha384`, `sha512`, `sha512-224`, `sha512-256`. `openssl speed` shows speedups ranging from 1.6x to 4.5x on the P-cores of Intel Core Ultra 5 238V. *Adrian Stanciu* * Changed default EC point formats configuration to support only 'uncompressed' format, and added `SSL_OP_LEGACY_EC_POINT_FORMATS` flag and options to re-enable previous default, if required. *Tim Perry* * Increased PKCS#12 default `macsaltlen` from 8 to 16, as, per NIST [SP 800-132], this improves interoperability for newly generated PKCS#12 stores between FIPS and non-FIPS implementations. *Dimitri John Ledkov* * Added `X509_CRL_get0_tbs_sigalg()` accessor for the signature `AlgorithmIdentifier` inside CRL's `TBSCertList`. *Theo Buehler* * Added OIDS for HKDFs with SHA-256, SHA-384, and SHA-512. Added ability to load HKDF configured with these explicit digests by name or OID. *Daniel Van Geest (CryptoNext Security)* * Added Intel AVX-512 and VAES optimizations for AES-CFB128 algorithms. Encryption performance on large buffers improved by 1.5—1.7x, while decryption speed increased by 20—23x. *Adrian Stanciu* * Added support for TLS 1.3 OCSP multi-stapling for server certs. * new `s_client` options: * `-ocsp_check_leaf`: Checks the status of the leaf (server) certificate. * `-ocsp_check_all`: Checks the status of all certificates in the server chain. * new `s_server` option: * `-status_all` Provides OCSP status information for the entire server certificate chain (multi-stapling) for TLS 1.3 and later. * Improved `-status_file` option can now be given multiple times to provide multiple files containing OCSP responses. *Michael Krueger, Martin Rauch* * Added `KEMRecipientInfo` (RFC 9629) and ML-KEM (`draft-ietf-lamps-cms-kyber`) support to CMS. *Daniel Van Geest (CryptoNext Security)* * Added support for FIPS 186-5 deterministic ECDSA signature generation to the FIPS provider. *Dimitri John Ledkov* OpenSSL 3.5 ----------- * Fix Out-of-bounds read in HTTP client `no_proxy` handling may trigger an out-of-bounds read if the `no_proxy` environment variable is * Aligned the behaviour of TLS and DTLS in the event of a `no_renegotiation` `no_renegotiation` alert was received. All versions of OpenSSL do this for TLS. From 3.2 a bug was exposed that meant that DTLS ignored `no_rengotiation`. We [CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456 [CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457 [CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798 [CVE-2026-28386]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28386 [CVE-2026-35188]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35188 [CVE-2026-42765]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42765 [CVE-2026-42771]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42771 [CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874 [CVE-2026-54876]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54876 [CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072 [CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073 [CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074 [CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075 [CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076 [CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803 [RFC 7250]: https://datatracker.ietf.org/doc/html/rfc7250 [RFC 7919]: https://datatracker.ietf.org/doc/html/rfc7919 [RFC 8422]: https://datatracker.ietf.org/doc/html/rfc8422 [RFC 8446 Section 4.6.1]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1 [RFC 8998]: https://datatracker.ietf.org/doc/html/rfc8998#name-iana-considerations [RFC 9849]: https://datatracker.ietf.org/doc/html/rfc9849 [SP 800-132]: https://csrc.nist.gov/pubs/sp/800/132/final [SP 800-185]: https://csrc.nist.gov/pubs/sp/800/185/final [SP 800-208]: https://csrc.nist.gov/pubs/sp/800/208/final [tls-hybrid-sm2-mlkem]: https://datatracker.ietf.org/doc/html/draft-yang-tls-hybrid-sm2-mlkem-03#name-iana-considerations
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244305): https://lists.openembedded.org/g/openembedded-core/message/244305 Mute This Topic: https://lists.openembedded.org/mt/120933141/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
