chore(deps): update dependency openssl/openssl to v4

[renovate]

This PR contains the following updates:

Package	Update	Change
openssl/openssl	major	3.6.4 → 4.0.2

---

Release Notes

openssl/openssl (openssl/openssl)

v4.0.2

Compare Source

• Fixed QUIC server being able to trigger double free when processing INITIAL
  packet.

  Severity: Moderate

  Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
  when channel creation fails for initial packet.

  Impact summary: Double free leads to heap corruption, which typically results
  in termination of QUIC server process, leading to a Denial of Service.
  There is so far no evidence that this double free is exploitable for remote
  code execution, thus it is considered highly improbable.

  Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle,
  and Feng Xue (ThreatBoon).

  ([CVE-2026-18798])

  Alexandr Nedvědický

• Fixed heap buffer overflow in CMS key unwrapping.

  Severity: Moderate

  Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer
  based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap
  primitive can write and cleanse more bytes than that query reports, causing
  an 8-byte out-of-bounds heap write.

  Impact summary: An attacker who supplies a crafted CMS message can trigger
  a deterministic 8-byte out-of-bounds heap write when the victim decrypts it
  with CMS_decrypt(), corrupting the heap and typically resulting in a Denial
  of Service.

  Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits).

  ([CVE-2026-63072])

  Daniel Kubec

• Fixed invalid pointer dereference in CMP server via crafted protectionAlg.

  Severity: Moderate

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP)
  password-based protection verification only checks whether
  the protectionAlg parameter was not NULL and not its ASN.1 type,
  before treating it as a PBMParameter. A crafted message can contain
  a parameter of a different type, which is then dereferenced as an invalid
  pointer.

  Impact summary: A remote, unauthenticated attacker can crash an application
  acting as a CMP server that accepts PBM-protected messages, or a CMP client
  talking to a malicious or intercepted CMP server, resulting in a Denial
  of Service.

  Reported by: Ying Dong and Bhabani Sankar Das.

  ([CVE-2026-63076])

  Daniel Kubec

• Fixed unbounded memory growth in QUIC server incoming channel queue.

  Severity: Low

  Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
  valid QUIC Initial packets for unknown destination connection IDs, it can
  allocate and queue new incoming channels without enforcing any limit.

  Impact summary: A remote peer that can make many INITIAL packets reach
  the server listener faster than the application accepts connections can
  cause the memory allocated to store the per-channel state to grow
  without any limits, potentially making the QUIC listener unavailable
  and causing a Denial of Service.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.

  ([CVE-2026-14456])

  Filipe Casal

• Fixed RPK server signature algorithm selection being able to dereference
  a missing certificate.

  Severity: Low

  Issue summary: In a server or client configuration with [RFC 7250] Raw Public
  Keys (RPKs) enabled, and only the private key (with no associated
  certificate) configured locally, a NULL pointer dereference may occur
  when the remote peer solicits raw public keys and also sends the typically
  omitted signature_algorithms_cert TLS extension.

  Impact summary: The impact is limited to a possible Denial of Service
  as a result of an application abort, no data disclosure or remote command
  execution are possible.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.

  ([CVE-2026-14457])

  Viktor Dukhovni

• Fixed excessive memory use buffering DTLS records for a future epoch.

  Severity: Low

  Issue summary: Receiving a DTLS record for a future epoch while a handshake
  is in progress causes OpenSSL to buffer far more memory than the record
  itself requires.

  Impact summary: A peer can use a small amount of network traffic to make
  an OpenSSL DTLS endpoint retain a disproportionately large amount of memory,
  which may lead to a Denial of Service.

  Reported by: Amazon Web Services.

  ([CVE-2026-54874])

  Matt Caswell

• Fixed client-side memory leak in OCSP response checking.

  Severity: Low

  Issue summary: A malicious TLS server can cause a memory leak in a TLS
  client that has enabled OCSP response checking by sending an OCSP response
  that contains no single response entries.

  Impact summary: An attacker can leak an attacker-tunable amount of memory
  per TLS handshake in a victim client application. A long-running client
  that repeatedly connects to a malicious server can have its memory
  exhausted, resulting in a Denial of Service.

  Reported by: Bhabani Sankar Das and Zhenzhe Shao.

  ([CVE-2026-54876])

  Mounir IDRASSI

• Fixed untrusted Sender DN being used as a format string in CMP response
  validation.

  Severity: Low

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response
  validation passed an unexpected response sender distinguished name directly
  as the format string to ERR_raise_data().

  Impact summary: A malicious or intercepted CMP endpoint can crash a CMP
  client that enforces an expected sender or uses a pinned server certificate
  whose subject becomes the default expected sender.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
  Brandon Luo, and TrendAI Zero Day Initiative.

  ([CVE-2026-63073])

  Filipe Casal

• Fixed CMP indefinite cache growth of extraCerts.

  Severity: Low

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches
  additional certificates (extraCerts) sent in a CMP message, but never
  expunges them (for instance, if they are invalid). If a server reuses
  an OSSL_CMP_CTX object frequently, this cache of extraCerts may grow
  unboundedly, and a malicious client may flood a CMP server with requests
  driving this growth.

  Impact Summary: Users utilizing a CMP server that reuses a single
  OSSL_CMP_CTX object for the lifetime of a server process may observe
  unbounded memory growth in the event a malicious client repeatedly sends
  requests containing unique extra certificates, which may lead to OOM
  conditions.

  Reported by: Pavol Zacik (Red Hat).

  ([CVE-2026-63074])

  Neil Horman

• Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.

  Severity: Low

  Issue Summary: When OpenSSL processes QUIC traffic from a peer
  that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only
  responses, the QUIC stack can retain ACK-only packet metadata
  for the lifetime of the connection.

  Impact Summary: A remote peer that can complete a QUIC handshake can cause
  connection-scoped memory growth, which may lead to a Denial of Service
  through memory exhaustion, especially with sustained traffic or many
  concurrent QUIC connections.

  Reported by: Opal Wright (Trail of Bits).

  ([CVE-2026-63075])

  Neil Horman

• Fixed possibility of AEAD forgeries with empty ciphertext when using
  EVP_Cipher().

  Severity: Low

  Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty
  ciphertext can report success without verifying the supplied authentication
  tag when the operation is finalized by calling the EVP_Cipher() function.

  Impact summary: Applications calling EVP_Cipher() on an empty ciphertext
  and expecting the call to check the AEAD tag may accept forged messages.

  Reported by: Billy Brumley (Rochester Institute of Technology).

  ([CVE-2026-75803])

  Billy Bob Brumley

• Added OPENSSL_armcap(3) documentation page.

  Paul Elliott

• Added support for selecting assembly code paths for LLVM-based Intel's icx
  compiler.

  Wolfgang Beck

• Updated compliance with TLS 1.3 session ticket lifetime requirements.
  TLS 1.3 clients now cap ticket_lifetime_hint to 7 days (604800 seconds)
  when processing new session ticket messages, in accordance
  with [RFC 8446 Section 4.6.1].

  Abel Thomas

• Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
  in CCM cipher mode.

  Mounir IDRASSI

v4.0.1

Compare Source

• Fixed QUIC server being able to trigger double free when processing INITIAL
  packet.

  Severity: Moderate

  Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
  when channel creation fails for initial packet.

  Impact summary: Double free leads to heap corruption, which typically results
  in termination of QUIC server process, leading to a Denial of Service.
  There is so far no evidence that this double free is exploitable for remote
  code execution, thus it is considered highly improbable.

  Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle,
  and Feng Xue (ThreatBoon).

  ([CVE-2026-18798])

  Alexandr Nedvědický

• Fixed heap buffer overflow in CMS key unwrapping.

  Severity: Moderate

  Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer
  based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap
  primitive can write and cleanse more bytes than that query reports, causing
  an 8-byte out-of-bounds heap write.

  Impact summary: An attacker who supplies a crafted CMS message can trigger
  a deterministic 8-byte out-of-bounds heap write when the victim decrypts it
  with CMS_decrypt(), corrupting the heap and typically resulting in a Denial
  of Service.

  Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits).

  ([CVE-2026-63072])

  Daniel Kubec

• Fixed invalid pointer dereference in CMP server via crafted protectionAlg.

  Severity: Moderate

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP)
  password-based protection verification only checks whether
  the protectionAlg parameter was not NULL and not its ASN.1 type,
  before treating it as a PBMParameter. A crafted message can contain
  a parameter of a different type, which is then dereferenced as an invalid
  pointer.

  Impact summary: A remote, unauthenticated attacker can crash an application
  acting as a CMP server that accepts PBM-protected messages, or a CMP client
  talking to a malicious or intercepted CMP server, resulting in a Denial
  of Service.

  Reported by: Ying Dong and Bhabani Sankar Das.

  ([CVE-2026-63076])

  Daniel Kubec

• Fixed unbounded memory growth in QUIC server incoming channel queue.

  Severity: Low

  Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
  valid QUIC Initial packets for unknown destination connection IDs, it can
  allocate and queue new incoming channels without enforcing any limit.

  Impact summary: A remote peer that can make many INITIAL packets reach
  the server listener faster than the application accepts connections can
  cause the memory allocated to store the per-channel state to grow
  without any limits, potentially making the QUIC listener unavailable
  and causing a Denial of Service.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.

  ([CVE-2026-14456])

  Filipe Casal

• Fixed RPK server signature algorithm selection being able to dereference
  a missing certificate.

  Severity: Low

  Issue summary: In a server or client configuration with [RFC 7250] Raw Public
  Keys (RPKs) enabled, and only the private key (with no associated
  certificate) configured locally, a NULL pointer dereference may occur
  when the remote peer solicits raw public keys and also sends the typically
  omitted signature_algorithms_cert TLS extension.

  Impact summary: The impact is limited to a possible Denial of Service
  as a result of an application abort, no data disclosure or remote command
  execution are possible.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.

  ([CVE-2026-14457])

  Viktor Dukhovni

• Fixed excessive memory use buffering DTLS records for a future epoch.

  Severity: Low

  Issue summary: Receiving a DTLS record for a future epoch while a handshake
  is in progress causes OpenSSL to buffer far more memory than the record
  itself requires.

  Impact summary: A peer can use a small amount of network traffic to make
  an OpenSSL DTLS endpoint retain a disproportionately large amount of memory,
  which may lead to a Denial of Service.

  Reported by: Amazon Web Services.

  ([CVE-2026-54874])

  Matt Caswell

• Fixed client-side memory leak in OCSP response checking.

  Severity: Low

  Issue summary: A malicious TLS server can cause a memory leak in a TLS
  client that has enabled OCSP response checking by sending an OCSP response
  that contains no single response entries.

  Impact summary: An attacker can leak an attacker-tunable amount of memory
  per TLS handshake in a victim client application. A long-running client
  that repeatedly connects to a malicious server can have its memory
  exhausted, resulting in a Denial of Service.

  Reported by: Bhabani Sankar Das and Zhenzhe Shao.

  ([CVE-2026-54876])

  Mounir IDRASSI

• Fixed untrusted Sender DN being used as a format string in CMP response
  validation.

  Severity: Low

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response
  validation passed an unexpected response sender distinguished name directly
  as the format string to ERR_raise_data().

  Impact summary: A malicious or intercepted CMP endpoint can crash a CMP
  client that enforces an expected sender or uses a pinned server certificate
  whose subject becomes the default expected sender.

  Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
  Brandon Luo, and TrendAI Zero Day Initiative.

  ([CVE-2026-63073])

  Filipe Casal

• Fixed CMP indefinite cache growth of extraCerts.

  Severity: Low

  Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches
  additional certificates (extraCerts) sent in a CMP message, but never
  expunges them (for instance, if they are invalid). If a server reuses
  an OSSL_CMP_CTX object frequently, this cache of extraCerts may grow
  unboundedly, and a malicious client may flood a CMP server with requests
  driving this growth.

  Impact Summary: Users utilizing a CMP server that reuses a single
  OSSL_CMP_CTX object for the lifetime of a server process may observe
  unbounded memory growth in the event a malicious client repeatedly sends
  requests containing unique extra certificates, which may lead to OOM
  conditions.

  Reported by: Pavol Zacik (Red Hat).

  ([CVE-2026-63074])

  Neil Horman

• Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.

  Severity: Low

  Issue Summary: When OpenSSL processes QUIC traffic from a peer
  that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only
  responses, the QUIC stack can retain ACK-only packet metadata
  for the lifetime of the connection.

  Impact Summary: A remote peer that can complete a QUIC handshake can cause
  connection-scoped memory growth, which may lead to a Denial of Service
  through memory exhaustion, especially with sustained traffic or many
  concurrent QUIC connections.

  Reported by: Opal Wright (Trail of Bits).

  ([CVE-2026-63075])

  Neil Horman

• Fixed possibility of AEAD forgeries with empty ciphertext when using
  EVP_Cipher().

  Severity: Low

  Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty
  ciphertext can report success without verifying the supplied authentication
  tag when the operation is finalized by calling the EVP_Cipher() function.

  Impact summary: Applications calling EVP_Cipher() on an empty ciphertext
  and expecting the call to check the AEAD tag may accept forged messages.

  Reported by: Billy Brumley (Rochester Institute of Technology).

  ([CVE-2026-75803])

  Billy Bob Brumley

• Added OPENSSL_armcap(3) documentation page.

  Paul Elliott

• Added support for selecting assembly code paths for LLVM-based Intel's icx
  compiler.

  Wolfgang Beck

• Updated compliance with TLS 1.3 session ticket lifetime requirements.
  TLS 1.3 clients now cap ticket_lifetime_hint to 7 days (604800 seconds)
  when processing new session ticket messages, in accordance
  with [RFC 8446 Section 4.6.1].

  Abel Thomas

• Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
  in CCM cipher mode.

  Mounir IDRASSI

v4.0.0

Compare Source

• Fixed heap use-after-free in PKCS7_verify().

  Severity: High

  Issue summary: A specially crafted PKCS#7 or S/MIME signed message could
  trigger a use-after-free during PKCS#7 signature verification.

  Impact summary: A use-after-free may result in process crashes, heap
  corruption, or, potentially, remote code execution.

  Reported by: Thai Duong (Calif.io in collaboration with Claude
  and Anthropic Research).

  ([CVE-2026-45447])

  Igor Ustinov

• Fixed CMS AuthEnvelopedData processing may accept forged messages.

  Severity: Moderate

  Issue Summary: Cryptographic Message Services (CMS) processing fails
  to perform sufficient input validation on the cipher and tag length fields
  of AuthEnvelopedData containers, leading to various potential compromises.

  Impact Summary: Attackers making use of these vulnerabilities may achieve
  key-equivalent functionality for a given CMS recipient and/or bypass
  integrity validation for a given message.

  Reported by: Asim Viladi Oglu Manizada, Alex Gaynor (Anthropic),
  Ying Dong, and Haiyang Huang.

  ([CVE-2026-34182])

  Neil Horman

• Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.

  Severity: Moderate

  Issue summary: Remote peer may exhaust heap memory of the QUIC server
  or client by flooding it with packets containing PATH_CHALLENGE frames.

  Impact summary: A malicious remote peer can cause an unbounded memory
  allocation which can lead to an abnormal termination of the application
  acting as a QUIC client or server and a Denial of Service.

  Reported by: Abhinav Agarwal.

  ([CVE-2026-34183])

  Abhinav Agarwal and Alexandr Nedvedicky

• Fixed double-free when checking OCSP stapled response.

  Severity: Moderate

  Issue summary: A malicious server can exploit TLS OCSP stapling by delivering
  a crafted response through the status_request extension, triggering
  a double-free in the client's certificate verification path.

  Impact summary: Successful exploitation allows an attacker to corrupt heap
  memory via a double-free, potentially leading to a Denial of Service
  or possibly an attacker controlled code execution or other undefined
  behavior.

  Reported by: Wang Kenaz (University of Illinois),
  Guido Vranken (Aisle Research), and Aaron Grattafiori (Nvidia).

  ([CVE-2026-35188])

  Daniel Kubec

• Fixed NULL pointer dereference in QUIC server initial packet handling.

  Severity: Moderate

  Issue summary: Receiving a QUIC initial packet with an invalid token
  may trigger a NULL pointer dereference in the OpenSSL QUIC server
  with address validation disabled.

  Impact summary: NULL pointer dereference typically causes abnormal
  termination of the affected QUIC server process and a Denial of Service.

  Reported by: Sunwoo Lee (KENTECH), Hyuk Lim (KENTECH),
  and Seunghyun Yoon (KENTECH).

  ([CVE-2026-42764])

  Sunwoo Lee (KENTECH), Hyuk Lim (KENTECH), and Seunghyun Yoon (KENTECH)

• Fixed AES-OCB IV ignored on EVP_Cipher() path.

  Severity: Moderate

  Issue summary: When an application drives an AES-OCB context through
  the public EVP_Cipher() one-shot interface, the application-supplied
  initialisation vector (IV) is silently discarded.

  Impact summary: Every message encrypted under the same key uses the same
  effective nonce regardless of the IV supplied by the caller, resulting
  in (key, nonce) reuse and loss of confidentiality. If the same code path
  is used to compute the authentication tag, the tag depends only
  on the (key, IV) pair and not on the plaintext or ciphertext, allowing
  universal forgery of arbitrary ciphertext from a single captured message.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-45445])

  Viktor Dukhovni

• Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.

  Severity: Low

  Issue summary: A signed integer overflow when sizing the destination
  buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap
  buffer overflow.

  Impact summary: A heap buffer overflow may lead to a crash or possibly
  attacker controlled code execution or other undefined behaviour.

  Reported by: Zehua Qiao and Jinwen He.

  ([CVE-2026-7383])

  Viktor Dukhovni

• Fixed out-of-bounds read in CMS password-based decryption.

  Severity: Low

  Issue summary: When CMS password-based decryption ([RFC 3211]/PWRI key
  unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode
  KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

  Impact summary: A heap buffer over-read may trigger a crash, which leads
  to Denial of Service for an application if the input buffer ends at a memory
  page boundary and the following page is unmapped. There is no information
  disclosure, as the over-read bytes are not revealed to the attacker.

  Reported by: Bhabani Sankar Das and Haruki Oyama (Waseda University).

  ([CVE-2026-9076])

  Nikola Pajkovský

• Fixed heap buffer over-read in ASN.1 content parsing.

  Severity: Low

  Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive
  element whose content exceeds 2 gigabytes in length may cause a heap buffer
  over-read on 64-bit Unix and Unix-like platforms.

  Impact summary: The heap buffer over-read may crash the application (Denial
  of Service) or to load into the decoded ASN.1 object contents of memory
  beyond the end of the input buffer. More typically, such ASN.1 elements
  would instead be truncated.

  Reported by: Frank Buss.

  ([CVE-2026-34180])

  Viktor Dukhovni

• Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.

  Severity: Low

  Issue Summary: The PKCS#12 file processing fails to perform sufficient input
  validation for files that use Password-Based Message Authentication Code 1
  (PBMAC1) integrity mechanism allowing a certificate and private key forgery.

  Impact Summary: An attacker impersonating a user can cause a service reading
  PKCS#12 files to accept forged certificates and private keys with a 1 in 256
  probability.

  Reported by: Pavol Žáčik (Red Hat) and Alex Gaynor (Anthropic).

  ([CVE-2026-34181])

  Alicja Kario (Red Hat)

• Fixed NULL dereference in certificate verification with OCSP Checking.

  Severity: Low

  Issue summary: When a partial-chain certificate verification is enabled
  together with OCSP response checking for the whole chain, a NULL dereference
  will happen if the verified chain does not have a self-signed trusted anchor,
  crashing the process.

  Impact summary: A NULL pointer dereference can trigger a crash which leads
  to a Denial of Service for an application.

  Reported by: Joshua Rogers (Aisle Research).

  ([CVE-2026-42765])

  Joshua Rogers (Aisle Research) and Daniel Kubec

• Fixed possible NULL dereference in password-dased CMS decryption.

  Severity: Low

  Issue summary: A specially crafted password-encrypted CMS message
  could trigger a NULL pointer dereference during CMS decryption.

  Impact summary: This NULL pointer dereference could lead to an application
  crash and a Denial of Service.

  Reported by: Mayank Jangid, Kushal Khemka, Hari Priandana,
  Bhabani Sankar Das, and Qifan Zhang (Palo Alto Networks).

  ([CVE-2026-42766])

  Igor Ustinov

• Fixed NULL pointer dereference in CRMF EncryptedValue decryption.

  Severity: Low

  Issue summary: An attacker-controlled CMP (Certificate Management Protocol)
  server could trigger a NULL pointer dereference in a CMP client application.

  Impact summary: A NULL pointer dereference could cause a crash
  of the application and a Denial of Service.

  Reported by: Zhanpeng Liu (Tencent Xuanwu Lab),
  Guannan Wang (Tencent Xuanwu Lab), and Guancheng Li (Tencent Xuanwu Lab).

  ([CVE-2026-42767])

  Igor Ustinov

• Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
  and PKCS7_decrypt().

  Severity: Low

  Issue summary: The CMS_decrypt() and PKCS7_decrypt() functions
  are vulnerable to Bleichenbacher-style attack when an attacker is able
  to provide CMS or S/MIME messages and observe the error code
  and/or decryption output.

  Impact summary: The Bleichenbacher-style attack allows an attacker to use
  the victim's vulnerable application as a way to decrypt or sign messages
  with the victim's private RSA key.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-42768])

  Dmitry Belyavskiy (Red Hat) and Alicja Kario (Red Hat)

• Fixed trust anchor substitution via cert/issuer typo in CMP
  rootCaKeyUpdate.

  Severity: Low

  Issue Summary: An error in the callback used to verify the certificate
  provided in a Root CA key update Certificate Management Protocol (CMP)
  message response rendered the certificate validation ineffectual,
  which could lead to escalation of credentials from the Registration
  Authority (RA) level to the root Certification Authority (root CA) level.

  Impact Summary: The Registration Authority could replace the root CA
  certificate for the CMP clients with an arbitrary root CA certificate.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-42769])

  Alex Gaynor (Anthropic) and Bob Beck

• Fixed FFC-DH peer validation uses attacker-supplied q.

  Severity: Low

  Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)
  peer key, the peer key is not properly checked for the subgroup membership.

  Impact summary: A malicious peer which presents an X9.42 key carrying
  the victim's p and g parameters, a forged q = r (a small prime factor
  of the cofactor (p − 1)/q_local), and a public value Y of order r can
  recover the victim's private key after a small number of key exchange
  attempts.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-42770])

  Alex Gaynor (Anthropic), Viktor Dukhovni, and Norbert Pócs

• Fixed possible out of bounds read in X509_VERIFY_PARAM_set1_email().

  Severity: Low

  Issue summary: When X509_VERIFY_PARAM_set1_email() is called
  by an application to validate a crafted e-mail address, such as during
  S/MIME message validation, an out of bounds read can happen.

  Impact summary: This out of bounds read will not directly exfiltrate
  the data read to the attacker, so, the most likely result is a crash
  and a Denial of Service.

  Reported by: TrendAI Zero Day Initiative.

  ([CVE-2026-42771])

  Bob Beck

• Fixed incorrect tag processing for empty messages in AES-GCM-SIV
  and AES-SIV modes.

  Severity: Low

  Issue summary: The implementations of AES-SIV ([RFC 5297]) and AES-GCM-SIV
  ([RFC 8452]) mishandle the authentication of AAD (Additional Authenticated
  Data) with an empty ciphertext, allowing forgery of such messages.

  Impact summary: An attacker can forge empty messages with arbitrary AAD
  to the victim's application using these ciphers.

  Reported by: Alex Gaynor (Anthropic).

  ([CVE-2026-45446])

  Dmitry Belyavskiy (Red Hat)

• Fixed excessive allocation of the handshake message buffer (aka HollowByte).

  Previously, we would allocate a buffer large enough to hold the full size of
  an incoming handshake message as advertised by the peer. This could be quite
  large (although it is bounded, e.g. for ClientHello this is approximately
  128 KiB). If the peer then fails to send the full handshake message, then the
  endpoint is left waiting for the remainder of the message to arrive and the
  memory is still allocated (i.e. a Slowloris attack). To prevent this, we
  incrementally grow the buffer as we receive the data.

  This issue was reported by Okta Red Team.

  Matt Caswell

• Fixed a regression introduced in 4.0.0 that led to a openssl pkey
  command crash when it was invoked to encrypt a private key with password
  being provided interactively.

  Viktor Dukhovni

• Fixed a regression introduced in 4.0.0 that led to openssl s_client -adv
  command prematurely terminating a session when reading input of 16384 bytes
  in one read() call.

  Eugene Syromiatnikov

• Fixed TLS 1.3 server not sending NewSessionTicket message
  after ciphersuite mismatch.

  Daniel Kubec

• Implemented validation of the minimal length of PSK identity
  being of at least one byte long, as required per [RFC 8446].

  Matt Caswell

• Fixed usage of stale application buffer pointer by kTLS implementation
  after incomplete writes when SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER is set,
  that led to invalid memory reads and sending of incorrect data.

  Ilya Maximets

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.