Changelog for openssl: 3.5.7 -> 4.0.1 Source: CHANGES.md - [OpenSSL 4.0](#openssl-40) - [OpenSSL 3.6](#openssl-36) ### Changes between 4.0.0 and 4.0.1 [9 Jun 2026] * Fixed double-free when checking OCSP stapled response. Severity: Moderate Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the `status_request` extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior. Reported by: Wang Kenaz (University of Illinois), Guido Vranken (Aisle Research), and Aaron Grattafiori (Nvidia). ([CVE-2026-35188]) *Daniel Kubec* * Fixed NULL dereference in certificate verification with OCSP Checking. Severity: Low Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. Reported by: Joshua Rogers (Aisle Research). ([CVE-2026-42765]) *Joshua Rogers (Aisle Research) and Daniel Kubec* * Fixed possible out of bounds read in `X509_VERIFY_PARAM_set1_email()`. Severity: Low Issue summary: When `X509_VERIFY_PARAM_set1_email()` is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker, so, the most likely result is a crash and a Denial of Service. Reported by: TrendAI Zero Day Initiative. ([CVE-2026-42771]) *Bob Beck* * Fixed a regression introduced in 4.0.0 that led to a `openssl pkey` command crash when it was invoked to encrypt a private key with password being provided interactively. *Viktor Dukhovni* * Fixed a regression introduced in 4.0.0 that led to `openssl s_client -adv` command prematurely terminating a session when reading input of 16384 bytes in one `read()` call. *Eugene Syromiatnikov* ### Changes between 3.6 and 4.0.0 [14 Apr 2026] * Added `-expected-rpks` option to the `openssl s_client` and `openssl s_server` commands. This makes it possible to specify one or more public keys expected from the remote peer that are then used to authenticate the connection. *Viktor Dukhovni* * Added `-hmac-env` and `-hmac-stdin` options to `openssl dgst` command. *Igor Ustinov* * Added LMS support for signature verification to `openssl pkeyutl` command. To enable this, LMS `SubjectPublicKeyInfo` encoder and decoders were added, and the LMS keymanager and signature code were updated. *Shane Lontis* * Added new `SSL_get0_sigalg()` and `SSL_get0_shared_sigalg()` functions to report the TLS signature algorithm name and codepoint for the peer advertised and shared algorithms respectively. These supersede the existing `SSL_get_sigalgs()` and `SSL_get_shared_sigalgs()` functions, which are only a good fit for TLS 1.2. The names reported are the IANA names, and are expected to consistently match the names expected in `SignatureAlgorithms` configuration settings, see `SSL_CONF_cmd(3)` for details. Previously reported names were not always directly usable for configurations, and were mostly OpenSSL-specific aliases that rarely matched the official IANA codepoint names. There is an associated change in how signature algorithms are reported by the `openssl s_client` and `openssl s_server` commands. They now use the new functions and report the IANA registered names of each signature scheme. Example new output: Signature Algorithms: mldsa65:mldsa87:mldsa44:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ed25519:ed448:ecdsa_brainpoolP256r1tls13_sha256:ecdsa_brainpoolP384r1tls13_sha384:ecdsa_brainpoolP512r1tls13_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512:ecdsa_sha224:rsa_pkcs1_sha224:dsa_sha224:dsa_sha256:dsa_sha384:dsa_sha512 *Viktor Dukhovni* * Implemented client-side predicted keyshare floating. When a tuple loses the last element that was tagged for transmission of a predicted client keyshare (by default `*X25519MLKEM768` and `*X25519` in their respective tuples), either because the group is not enabled at compile-time, or because it is removed by configuration (e.g. `DEFAULT:-`), if the tuple remains non-empty, the keyshare is inherited by the first (i.e. most preferred) remaining element of the tuple. *Viktor Dukhovni* * Implemented `OSSL_STORE` support for `EVP_SKEY` objects, that includes addition of new `-skeyuri` and `-storepass` options to `openssl enc` command, addition of a new `-skeys` option to `openssl storeutl` command, addition of `OSSL_STORE_INFO_SKEY` `OSS_STORE` object type and the relevant `OSSL_STORE_INFO_get0_SKEY()`, `OSSL_STORE_INFO_get1_SKEY()`, and `OSSL_STORE_INFO_new_SKEY()` APIs. *Dmitry Belyavskiy* * Added support for [RFC 8998], signature algorithm `sm2sig_sm3`, key exchange group `curveSM2`, and [tls-hybrid-sm2-mlkem] post-quantum group `curveSM2MLKEM768`. Verification of SM2-signed certificates required changing the default *distinguishing identifier* from empty to the constant ASCII string "1234567812345678". An explicit empty distinguishing identifier value may need to be used to verify or create signatures that are compatible with versions of OpenSSL prior to 4.0. With the command-line tools an empty value can be specified with the use of either the **-pkeyopt** (`openssl-pkeyutl(1)`) or **-sigopt** (`openssl-dgst(1)`) option with a value of "distid:". *Viktor Dukhovni* * Added support for TLS 1.3 SM cipher suites `TLS_SM4_GCM_SM3` and `TLS_SM4_CCM_SM3` from [RFC 8998]. *Milan Brož* * Added cSHAKE function support as per [SP 800-185]. *Shane Lontis* * Added "ML-DSA-MU" digest algorithm support. *Shane Lontis* * Added SNMP KDF (`EVP_KDF_SNMPKDF`) to `EVP_KDF`. *Barry Fussell and Helen Zhang* * Added SRTP KDF (`EVP_KDF_SRTPKDF`) to `EVP_KDF`. *Barry Fussell and Helen Zhang* * Implemented [RFC 7919], adding support for negotiated FFDHE key exchange in TLS 1.2. *Joachim Vandersmissen* (with additional support from *Viktor Dukhovni*) * Added AKID verification checks when `X509_V_FLAG_X509_STRICT` is set. Raise `X509_V_ERR_MISSING_AUTHORITY_KEY_IDENTIFIER` when AKID is not present. Raise `X509_V_ERR_EMPTY_AUTHORITY_KEY_IDENTIFIER` when AKID has no attributes. Raise `X509_V_ERR_AKID_ISSUER_SERIAL_NOT_PAIRED` when `authorityCertIssuer` and `authorityCertSerialNumber` fields are not paired. *Daniel Kubec* * Implemented [RFC 9849], adding support for Encrypted Client Hello (ECH). See `doc/design/ech-api.md` for details. *Stephen Farrell* (with much support from *Matt Caswell* and *Tomáš Mráz*) * Implemented display of CPU capabilities in `openssl version -c` output on POWER and SPARC platforms, added `OPENSSL_ppccap(3)` manual page. *Bernd Edlinger, Nia Alarie, and George Wilson* * Added `OSSL_ESS_check_signing_certs_ex()` function. This API call is an extension to `OSSL_ESS_check_signing_certs()` that adds the ability to specify a library context and property query when fetching algorithms to validate a given certificate. *Neil Horman* * Added `OPENSSL_sk_set_cmp_thunks()` function to allow for proper typecasting during comparison of elements in a `STACK_OF` structure. *Neil Horman* * Added `OSSL_PARAM_clear_free` function that allows cleansing `PARAM`s that contain sensitive information, and switched to its use where it is suitable. *Simo Source* * Added `ASN1_BIT_STRING_get_length()` function, that returns the number of octets and the number of unused bits in an `ASN1_BIT_STRING` object. *Bob Beck* * Added `ASN1_BIT_STRING_set1()` function to set a bit string to a value, including the length in bytes and the number of unused bits. Internally, `ASN1_BIT_STRING_set_bit()` has also been modified to keep the number of unused bits correct when changing an `ASN1_BIT_STRING`. *Bob Beck* * Added `PACKET_msg_start()` function, that allows obtaining start of a `PACKET` buffer. *Matt Caswell* * Added `SSL_add1_dnsname()`, `SSL_set1_dnsname()`, `SSL_add1_ipaddr()`, and `SSL_set1_ipaddr()` functions as a replacement for `SSL_add1_host()` and `SSL_set1_host()` that are deprecated now. The new replacement API functions was added to support checking multiple names against a certificate with `X509_VERIFY_PARAM`. See `X509_VERIFY_PARAM_set_flags(3)` for full details. *Bob Beck* * Added `SSL_listen_ex()` function, that, together with added ability to create "blank" SSL objects using `OSSL_QUIC_method()`, allows implementing polling of inbound connections in QUIC in a fashion similar to DTLS. *Neil Horman* * Added `SSL_CTX_get0_alpn_protos()` and `SSL_get0_alpn_protos()` functions. *Daniel Kubec* * Added `SSL_CTX_is_server()` function, that is similar to `SSL_is_server()`, but takes `SSL_CTX` object as an argument. *Igor Ustinov* * Added `EVP_MD_CTX_serialize()`/`EVP_MD_CTX_deserialize()` functions. These functions allow to export the internal state of a Digest and re-import it later to continue a computation from a specific checkpoint. Only SHA-2 and the SHA-3 family (Keccak, SHAKE, SHA-3) of functions currently support this functionality. *Simo Sorce* * Added `BIO_set_send_flags()` function that allows setting flags passed to `send()`, `sendto()`, and `sendmsg()`. The main intention is to allow setting the `MSG_NOSIGNAL` flag to avoid a crash on receiving the `SIGPIPE` signal. *Igor Ustinov* * Added `X509v3_delete_extension()` function, that extends `X509v3_delete_ext()` by deallocating the extension stack if it becomes empty, as a convenience wrapper useful for optional X.509 extensions. *Viktor Dukhovni* * Added ability to specify ML-KEM and ML-DSA encoding formats on a per-key basis, by setting `output-formats` `EVP_PKEY` encoding parameter appropriately via `OSSL_ENCODER_CTX_set_params(3)`. *Viktor Dukhovni* * Added documentation for `BIO` flags and related functions. *Igor Ustinov* * FIPS self tests can now be deferred and run as needed when installing the FIPS module with the `-defer_tests` option of the `openssl fipsinstall` command. *Simo Sorce* * Lower bounds checks are now enforced when using `PKCS5_PBKDF2_HMAC` API with FIPS provider. When using the FIPS provider via the `PKCS5_PBKDF2_HMAC` API, password protected encrypted files will now have lower bounds checks (minimum iteration count, minimum password length, salt size and derived key lengths) enforced by default. Prior to upgrading to this version, users may want to check if their password protected key–stores are encrypted using short passwords, salts, low iteration counts for PBKDF or weaker ciphers. To upgrade to the new defaults one can decrypt the keys with a previous OpenSSL version or the default provider, and then re-encrypt them with the newer OpenSSL (using the FIPS provider), thus upgrading to longer password, salt length and AES-256 CBC. *Dimitri John Ledkov* * Added support for using either static or dynamic VC runtime linkage on Windows. Using the `enable-static-vcruntime` configuration option, OpenSSL can now be configured to use the static or dynamic `vcruntime.dll` linkage. The multithreaded or single threaded static VC runtime is selected based on the `enable-threads` option. *Neil Horman* * Added configure options to disable KDF algorithms for `hmac-drbg-kdf`, `kbkdf`, `krb5kdf`, `pvkkdf`, `snmpkdf`, `sskdf`, `sshkdf`, `x942kdf`, and `x963kdf`. *Shane Lontis* * Removed configure options can now only be disabled. You may continue to use `disable-` syntax, which will remain supported. Using `enable-` for a removed feature is no longer permitted. *Andrew Dinh* * Added restrictions on the maximum number of TLS `key_share`s (16) that a server will pay attention to, as well as the maximum number of supported `group`s (128) and `sig_alg`s (128). Any sent beyond these limits are ignored, in order to avoid clients sending excessively long lists in these extensions. *Matt Caswell* * Removed specialised built-in logic for adding the SKID and AKID extensions from `openssl x509`, `openssl req`, and `openssl ca` commands, these extensions are handled through configuration files and command-line options just like any other extension. See their documentation and also `x509v3_config(5)` for additional details. Updated the syntax of the `subjectKeyIdentifier` (SKID) and `authorityKeyIdentifier` (AKID) extensions, introducing the `nonss` qualifier for the `keyid` and `issuer` keywords. The x509 "mini-CA" now attempts to find extension settings in the default configuration file even if neither the `-extfile` nor the `-extensions` option is explicitly specified. Failure to open the default configuration is silently ignored. The settings in the stock OpenSSL 4.0 configuration file arrange for addition of the requisite SKID and AKID extensions. Other configuration files may need to be adjusted if desired. *Viktor Dukhovni* * Enabled Server verification by default in `s_server` when the `-verify_return_error` option is enabled. *Ryan Hooper* * Removed extra leading '00:' when printing key data such as an RSA modulus in hexadecimal format where the first (most significant) byte is >= 0x80. This had been added artificially to resemble ASN.1 DER encoding internals. Fixing this also makes sure that key output always has the expected length. *David von Oheimb* * Standardized the width of hexadecimal dumps to 24 bytes for signatures (to stay within the 80 characters limit) and 16 bytes for everything else. *Beat Bolli* * Updated the default group list to append `SecP256r1MKEM768` and `curveSM2MLKEM768` to the first tuple in that order after `*X25519MLKEM768`. Also inserted a penultimate tuple with `curveSM2` (just before the `FFDHE` groups). *Viktor Dukhovni* * Consolidated processing of SM2 and EdDSA signatures with essentially identical code for ECDSA in the `openssl speed` command. The output format has changed slightly to report the EC curve name rather than its bit size. *Viktor Dukhovni* * CRLs with a malformed Issuing Distribution Point extensions are now rejected. *Daniel Kubec* * CRLs with malformed `CRL Number` or `Delta CRL Indicator` extensions are now rejected. *Daniel Kubec* * Fixed CRLs with invalid `ASN1_TIME` in `invalidityDate` extensions, where verification incorrectly succeeded. Enforced proper handling of `ASN1_TIME` validation results so that any CRL containing invalid time fields is rejected immediately, preventing the error from propagating to verification. *Daniel Kubec* * CRLs with a `Certificate Issuer` extension in a certificate revocation entry are now rejected, unless the `Indirect` flag is set to `TRUE` in the `Issuing Distribution Point` extension of the CRL. *Daniel Kubec* * `SSL_get_error()` no longer depends on the state of the error stack, so it is no longer necessary to empty the error queue before the TLS/SSL I/O operations. *Igor Ustinov* * `ASN1_STRING` has been made opaque. Access to values from `ASN1_STRING` and related types should be done with the appropriate accessor functions. The various `ASN1_STRING_FLAG` values have been made private. *Bob Beck* * `OPENSSL_cleanup()` now runs in a global destructor, or not at all by default: `OPENSSL_cleanup()` will no longer by default free global objects when run from an application. Instead it sets a flag for a global destructor to do this after the process exits, and after subordinate libraries using OpenSSL have run their destructors. If destructor support is not available, `OPENSSL_cleanup()` will do nothing, leaving the global objects to be cleaned up by the operating system. *Bob Beck* * `X509_ALGOR_set_md()` function now returns a value indicating success or failure. *David von Oheimb* * Changed `BIO_snprintf()` implementation to use `snprintf()` provided by system's libc (instead of relying on internal implementation), making it bug-for-bug compatible with it. *Alexandr Nedvedicky* * Added `X509_check_certificate_times()` function, as well as the `` interface from BoringSSL/LibreSSL, that replace now deprecated `X509_cmp_time()`, `X509_cmp_current_time()`, and `X509_cmp_timeframe()`. See `X509_check_certificate_times(3)` for details. *Bob Beck* * `const`-corrected `time_t` arguments for `X509_cmp_time()`, `X509_time_adj()`, and `X509_time_adj_ex()`. *Frederik Wedel-Heinen* * Made `X509_ATTRIBUTE` accessor functions `const`-correct. The functions `X509_ATTRIBUTE_get0_object()`, `X509_ATTRIBUTE_get0_type()`, and `X509_ATTRIBUTE_get0_data()` now accept `const X509_ATTRIBUTE *` and return `const` pointers. Related PKCS#12 functions `PKCS12_get_attr_gen()`, `PKCS12_get_attr()`, and `PKCS8_get_attr()` have also been updated to return `const ASN1_TYPE *`. *kovan* * Made `X509_PUBKEY` accessor functions `const`-correct. *Bob Beck* * `const`-corrected various function return values, particularly in `X509` and related areas, and when functions were returning non-`const` objects owned by a `const` parameter. *Bob Beck* * Many functions accepting `X509 *` arguments, or returning values from a `const` `X509 *` have been changed to take/return `const` arguments. The most visible changes are places where pointer values are returned from a `const` `X509 *` object. In many places where these were non `const` values being returned from a `const` object, these pointer values have now been made `const`. The goal of this change is to enable future improvements in X.509 certificate handling. For full details see the relevant section in `ossl-migration-guide(7)`. *Bob Beck* * `const`-corrected various function parameters, in particular for `X509`-related functions. *David von Oheimb* * `const`-corrected various `X509`-related functions: `X509_get_pathlen()`, `X509_check_ca()`, `X509_check_purpose()`, `X509_get_proxy_pathlen()`, `X509_get_extension_flags()`, `X509_get_key_usage()`, `X509_get_extended_key_usage()`, `X509_get0_subject_key_id()`, `X509_get0_authority_key_id()`, `X509_get0_authority_issuer()`, `X509_get0_authority_serial()`, `X509_get0_distinguishing_id()`. *Bob Beck* * Removed needless `const` qualifiers from scalar type arguments in the public APIs, mostly for AES and Camellia. *David von Oheimb* * Fixed a bug that allowed TLS 1.2 ciphers to be added to the TLS 1.3 `ciphersuites` list, and for that list to contain duplicates. Cipher configuration strings for both TLS 1.2 and 1.3 are now case-insensitive. *Viktor Dukhovni* * Deprecated `ASN1_OBJECT_new()` function. Refer to `ossl-migration-guide(7)` for more info. *Frederik Wedel-Heinen* * Deprecated `X509_NAME_get_text_by_NID()` and `X509_NAME_get_text_by_OBJ()` functions, and documented them as such. *Bob Beck* * Removed the `SSL_TXT_FIPS` option. This was a remnant of the old FIPS canister and wasn't used anymore. *Dr Paul Dale* * Removed `OPENSSL_atexit()` function. *Bob Beck* * Removed critical extension enforcement for `EXFLAG_BCONS_CRITICAL`, `EXFLAG_AKID_CRITICAL`, `EXFLAG_SKID_CRITICAL`, and `EXFLAG_SAN_CRITICAL`, as it was incorrect. These checks were intended as CA requirements to prevent misinterpretation by verifiers that don't support certain extensions. However, since we do support these extensions, there is no requirement for them to be marked as critical. Enforcing that on `X509_V_FLAG_X509_STRICT` was a mistake. *Daniel Kubec* * Removed support for an SSLv2 Client Hello. When a client wanted to support both SSLv2 and higher versions like SSLv3 or even TLSv1, it needed to send an SSLv2 Client Hello. SSLv2 support itself was removed in OpenSSL 1.1.0, but there was still compatibility code for clients sending an SSLv2 Client Hello. Since we no longer support SSLv2 Client Hello, `SSL_client_hello_isv2()` is now deprecated and always returns 0. *Kurt Roeckx* * Removed support for SSLv3. SSLv3 has been deprecated since 2015, and OpenSSL had it disabled by default since version 1.1.0 (2016). *Kurt Roeckx* * Support of deprecated elliptic curves in TLS according to [RFC 8422] was disabled at compile-time by default. To enable it, use the `enable-tls-deprecated-ec` configuration option. *Dmitry Belyavskiy* * Support of explicit EC curves was disabled by default, an error will occur if an explicit EC curve doesn't match any known one. A new configuration option, `enable-ec_explicit_curves`, is added. *Dmitry Belyavskiy* * Removed `c_rehash` script tool. Use `openssl rehash` instead. *Norbert Pócs* * `libcrypto` no longer cleans up globally allocated data via `atexit()`. This data is cleaned up automatically by the OS. Some memory leak detectors may report spurious allocated and reachable memory at application exit. To avoid such spurious leak detection reports the application may call `OPENSSL_cleanup()` before the process exits. *Alexandr Nedvedicky* * Removed the `crypto-mdebug-backtrace` configuration option entirely. The option has been a no-op since OpenSSL 1.0.2. *Neil Horman* * Removed the deprecated function `ASN1_STRING_data()`. *Bob Beck* * Removed the `ASN1_STRING_FLAG_X509_TIME` define. *Bob Beck* * Dropped `darwin-i386{,-cc}` and `darwin-ppc{,64}{,-cc}` targets from Configurations. *Daniel Kubec and Eugene Syromiatnikov* * Removed support for engines. The `no-engine` build option and the `OPENSSL_NO_ENGINE` macro are always present. Applications that use `ENGINE_` functions without `OPENSSL_NO_ENGINE` guards can be built by defining a macro `OPENSSL_ENGINE_STUBS`; however, all these functions will return error when called. Provider API should be used to replace engine functionality. *Milan Brož*, *Neil Horman*, *Norbert Pócs* * Removed deprecated support for custom `EVP_CIPHER`, `EVP_MD`, `EVP_PKEY`, and `EVP_PKEY_ASN1` methods (`EVP_CIPHER_meth_*`, `EVP_MD_meth_*`, `EVP_PKEY_meth_*`, and `EVP_PKEY_asn1_*` function families, respectively). *Matt Caswell* * Removed deprecated fixed SSL/TLS version methods (`{SSLv3,{D,}TLSv1{,_1,_2}}{,_client,_server}_method()` functions), the migrating application should use `TLS_method()`, `TLS_client_method()`, and `TLS_server_method()` functions instead. *Frederik Wedel-Heinen* * Removed `BIO_f_reliable()` implementation without replacement. It was broken since 3.0 release without any complaints. *Tomáš Mráz* * Removed deprecated functions `ERR_get_state()`, `ERR_remove_state()` and `ERR_remove_thread_state()`. The `ERR_STATE` object is now always opaque. *Tomáš Mráz* * Removed the deprecated `msie-hack` option from the `openssl ca` command. *Bob Beck* OpenSSL 3.6 ----------- ### Changes between 3.6.1 and 3.6.2 [7 Apr 2026] * Fixed out-of-bounds read in AES-CFB-128 on x86-64 CPUs with AVX-512 support. Severity: Low Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not written to output. Reported by: Stanislav Fort (Aisle Research), Pavel Kohout (Aisle Research), and Alex Gaynor (Anthropic). ([CVE-2026-28386]) *Stanislav Fort, Pavel Kohout, and Alex Gaynor* * Fixed performance regressions introduced in 3.6 caused by the lack of usage of CPU-capability-specific optimisations with non-EVP APIs, as the capability detection was no longer performed during library load. *Bob Beck* ### Changes between 3.6.0 and 3.6.1 [27 Jan 2026] * Fixed a regression in `X509_V_FLAG_CRL_CHECK_ALL` flag handling by restoring its pre-3.6.0 behaviour of being ignored when `X509_V_FLAG_CRL_CHECK` flag is not set, and no longer implying the latter flag instead. *Carter Thaxton* * Fixed a regression that caused generation of empty stapled OCSP responses when at least one certificate in the certificate chain had a stapled OCSP response present, causing handshake failures for OpenSSL 3.6.0 servers with various client implementations, including GnuTLS and BoringSSL. *Martin Rauch* * Fixed exit code of `openssl x509` command with `-checkend` option in use. *Stefan Rieche* * Reverted a change in behaviour of the single stapled OCSP response API with respect to the ownership of the OCSP response object that caused a memory leak. *Remi Gacogne and Tomáš Mráz* ### Changes between 3.5 and 3.6.0 [1 Oct 2025] * Added support for `EVP_SKEY` opaque symmetric key objects to the key derivation and key exchange provider methods. Added `EVP_KDF_CTX_set_SKEY()`, `EVP_KDF_derive_SKEY()`, and `EVP_PKEY_derive_SKEY()` functions. *Dmitry Belyavskiy and Simo Sorce* * Added PCT for key import for SLH-DSA when in FIPS mode. *Dr Paul Dale* * Added `i2d_PKCS8PrivateKey(3)` API to complement `i2d_PrivateKey(3)`, the former always outputs PKCS#8. *Viktor Dukhovni* * Implemented interleaved AES-CBC+HMAC-SHA algorithm on AArch64. *Fangming Fang* * Added NIST security categories for PKEY objects. *Dr Paul Dale* * Added notification when all stream FINs are acknowledged in QUIC. Introduced `ossl_quic_channel_notify_flush_done()` so that once final FINs are ACKed, the channel transitions to terminating and `SSL_poll()` signals completion. This allows applications to progress shutdown reliably. *Alexandr Nedvědický* * Added array memory allocation routines and converted suitable memory allocation calls in the library to them. *Eugene Syromiatnikov* * Fixed behavior change of EC keygen by adding the generic error entry if the provider did not itself add an error entry onto the queue. That way, there always is an error on the error queue in case of a failure, but no behavior change in case the provider emitted the error entry itself. *Ingo Franzki* * Documented all the environment variables used across the project in `openssl-env(7)` and in specific man pages. *Eugene Syromiatnikov* * Added SHA-2 assembly implementation enhancing performance for LoongArch. Added optimized SM3, MD5, SHA-256, SHA-512 implementation using Zbb extension for RISC-V. *Julian Zhu* * Added options `CRYPTO_MEM_SEC` and `CRYPTO_MEM_SEC_MINSIZE` to `openssl` app to initialize secure memory at the beginning of `openssl` app. *Norbert Pócs* * Resolved compiler warnings on Win64 builds. *Tomáš Mráz* * Extended new `CRYPTO_THREAD_[get|set]_local` API to reduce the usage of OS thread-local variables. *Neil Horman* * Added `make` targets `build_inst_sw` and `build_inst_programs` which have the functionality to split the build into two parts, e.g. when tests should be built with different compiler flags than the installed software. *Pavol Zacik* * Refactored `OSSL_PARAM` name parsing so that automatically generated parsers are used instead of `OSSL_PARAM_locate()` calls. This should also ensure that the list of acceptable parameters better matches those which are actually processed. It should also provide a small performance improvement, because repeated iteration over passed parameter arrays is avoided. *Dr Paul Dale* * Introduced `SSL_OP_SERVER_PREFERENCE`, superseding misleadingly named `SSL_OP_CIPHER_SERVER_PREFERENCE`. *Michael Baentsch* * Added LMS signature verification support as per [SP 800-208]. This support is present in both the FIPS and default providers. *Shane Lontis and Paul Dale* * Introduced use of `` when handling JSON encoding in the OpenSSL codebase, replacing the previous use of `int` for these boolean values. *Alexis Goodfellow* * An ANSI-C toolchain is no longer sufficient for building OpenSSL. The code should be built using compilers supporting C-99 features. *Alexandr Nedvědický* * Support for the VxWorks platforms has been removed. These platforms were unadopted, unmaintained and reported to be non-functional. *Anthony Ioppolo* * Relaxed the path check in OpenSSL's `file:` scheme implementation for `OSSL_STORE`. Previously, when the `file:` scheme is an explicit part of the URI, our implementation required an absolute path, such as `file:/path/to/file.pem`. This requirement is now relaxed, allowing `file:path/to/file.pem`, as well as `file:file.pem`. *Richard Levitte* * Changed `openssl-pkey(1)` to match the documentation when private keys are output in DER format (`-outform DER`) by producing the PKCS#8 form by default. Previously, this would output the *traditional* form for those older key types (`DSA`, `RSA`, `ECDSA`) that had such a form. The `-traditional` flag has been extended to support explicit requests to output that format in DER format (it was previously PEM-only). *Viktor Dukhovni* * Added an `openssl configutl` utility for processing the OpenSSL configuration file and dumping the equal configuration file. *Dmitry Belyavskiy based on Clemens Lang's code* * Added support for setting a free function thunk to `OPENSSL_sk` stack types. Using a thunk allows the type specific free function to be called with the correct type information from generic functions like `OPENSSL_sk_pop_free()`. *Frederik Wedel-Heinen* * Enabled x86-64 SM4 optimizations with SM4 ISA Extension available starting Lunar Lake and Arrow Lake S CPUs. The expected performance improvement is ~3.6x for `sm4-cbc`, ~2.9x for `sm4-gcm`, ~9.2x for `sm4-xts`, ~5.3x for `sm4-ccm` (on average, may vary depending on the data size) on Arrow Lake S. *Alina Elizarova* * Enabled x86-64 SM3 optimizations with SM3 ISA Extension available starting Lunar Lake and Arrow Lake S CPUs. The expected performance improvement is ~2.2—4.7x (depends on the data size) on Arrow Lake S. *Alina Elizarova* * Enabled x86-64 SHA-512 optimizations with SHA512 ISA Extension. Optimized digests: `sha384`, `sha512`, `sha512-224`, `sha512-256`. `openssl speed` shows speedups ranging from 1.6x to 4.5x on the P-cores of Intel Core Ultra 5 238V. *Adrian Stanciu* * Changed default EC point formats configuration to support only 'uncompressed' format, and added `SSL_OP_LEGACY_EC_POINT_FORMATS` flag and options to re-enable previous default, if required. *Tim Perry* * Increased PKCS#12 default `macsaltlen` from 8 to 16, as, per NIST [SP 800-132], this improves interoperability for newly generated PKCS#12 stores between FIPS and non-FIPS implementations. *Dimitri John Ledkov* * Added `X509_CRL_get0_tbs_sigalg()` accessor for the signature `AlgorithmIdentifier` inside CRL's `TBSCertList`. *Theo Buehler* * Added OIDS for HKDFs with SHA-256, SHA-384, and SHA-512. Added ability to load HKDF configured with these explicit digests by name or OID. *Daniel Van Geest (CryptoNext Security)* * Added Intel AVX-512 and VAES optimizations for AES-CFB128 algorithms. Encryption performance on large buffers improved by 1.5—1.7x, while decryption speed increased by 20—23x. *Adrian Stanciu* * Added support for TLS 1.3 OCSP multi-stapling for server certs. * new `s_client` options: * `-ocsp_check_leaf`: Checks the status of the leaf (server) certificate. * `-ocsp_check_all`: Checks the status of all certificates in the server chain. * new `s_server` option: * `-status_all` Provides OCSP status information for the entire server certificate chain (multi-stapling) for TLS 1.3 and later. * Improved `-status_file` option can now be given multiple times to provide multiple files containing OCSP responses. *Michael Krueger, Martin Rauch* * Added `KEMRecipientInfo` (RFC 9629) and ML-KEM (`draft-ietf-lamps-cms-kyber`) support to CMS. *Daniel Van Geest (CryptoNext Security)* * Added support for FIPS 186-5 deterministic ECDSA signature generation to the FIPS provider. *Dimitri John Ledkov* OpenSSL 3.5 ----------- * Fix Out-of-bounds read in HTTP client `no_proxy` handling may trigger an out-of-bounds read if the `no_proxy` environment variable is * Aligned the behaviour of TLS and DTLS in the event of a `no_renegotiation` `no_renegotiation` alert was received. All versions of OpenSSL do this for TLS. From 3.2 a bug was exposed that meant that DTLS ignored `no_rengotiation`. We [CVE-2026-28386]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28386 [CVE-2026-35188]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35188 [CVE-2026-42765]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42765 [CVE-2026-42771]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42771 [RFC 7919]: https://datatracker.ietf.org/doc/html/rfc7919 [RFC 8422]: https://datatracker.ietf.org/doc/html/rfc8422 [RFC 8998]: https://datatracker.ietf.org/doc/html/rfc8998#name-iana-considerations [RFC 9849]: https://datatracker.ietf.org/doc/html/rfc9849 [SP 800-132]: https://csrc.nist.gov/pubs/sp/800/132/final [SP 800-185]: https://csrc.nist.gov/pubs/sp/800/185/final [SP 800-208]: https://csrc.nist.gov/pubs/sp/800/208/final [tls-hybrid-sm2-mlkem]: https://datatracker.ietf.org/doc/html/draft-yang-tls-hybrid-sm2-mlkem-03#name-iana-considerations