What changed in OpenSSL from 3 to 4

OpenSSL 4.0.2 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

• Fixed QUIC server being able to trigger double free when processing INITIAL packet. (CVE-2026-18798)

• Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

• Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

• Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)

• Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)

• Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

• Fixed client-side memory leak in OCSP response checking. (CVE-2026-54876)

• Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)

• Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

• Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)

• Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

• Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

OpenSSL 4.0.1 is a security patch release. The most severe CVE fixed in this release is High.

This release incorporates the following bug fixes and mitigations:

• Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447)

• Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182)

• Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler. (CVE-2026-34183)

• Fixed double-free when checking OCSP stapled response. (CVE-2026-35188)

• Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)

• Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445)

• Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)

• Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)

• Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)

• Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)

• Fixed NULL dereference in certificate verification with OCSP Checking. (CVE-2026-42765)

• Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)

• Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767)

• Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt(). (CVE-2026-42768)

• Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate. (CVE-2026-42769)

• Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770)

• Fixed possible out of bounds read in X509_VERIFY_PARAM_set1_email(). (CVE-2026-42771)

• Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)

• Fixed a regression introduced in 4.0.0 that led to a openssl pkey command crash when it was invoked to encrypt a private key with password being provided interactively.

• Fixed a regression introduced in 4.0.0 that led to openssl s_client -adv command prematurely terminating a session when reading input of 16384 bytes in one read() call.

OpenSSL 4.0.0 is a feature release adding significant new functionality to OpenSSL.

This release incorporates the following potentially significant or incompatible changes:

• Removed extra leading '00:' when printing key data such as an RSA modulus in hexadecimal format where the first (most significant) byte is >= 0x80.

• Standardized the width of hexadecimal dumps to 24 bytes for signatures (to stay within the 80 characters limit) and 16 bytes for everything else.

• Lower bounds checks are now enforced when using PKCS5_PBKDF2_HMAC API with FIPS provider.

• Added AKID verification checks when X509_V_FLAG_X509_STRICT is set.

• Augmented CRL verification process with several additional checks.

• libcrypto no longer cleans up globally allocated data via atexit().

• BIO_snprintf() now uses snprintf() provided by libc instead of internal implementation.

• OPENSSL_cleanup() now runs in a global destructor, or not at all by default.

• ASN1_STRING has been made opaque.

• Signatures of numerous API functions, including those that are related to X509 processing, are changed to include const qualifiers for argument and return types, where suitable.

• Deprecated X509_cmp_time(), X509_cmp_current_time(), and X509_cmp_timeframe() in favor of X509_check_certificate_times().

• Removed support for the SSLv2 Client Hello.

• Removed support for SSLv3. SSLv3 has been deprecated since 2015, and OpenSSL had it disabled by default since version 1.1.0 (2016).

• Removed support for engines. The no-engine build option and the OPENSSL_NO_ENGINE macro are always present.

• Support of deprecated elliptic curves in TLS according to RFC 8422 was disabled at compile-time by default. To enable it, use the enable-tls-deprecated-ec configuration option.

• Support of explicit EC curves was disabled at compile-time by default. To enable it, use the enable-ec_explicit_curves configuration option.

• Removed c_rehash script tool. Use openssl rehash instead.

• Removed the deprecated msie-hack option from the openssl ca command.

• Removed BIO_f_reliable() implementation without replacement. It was broken since 3.0 release without any complaints.

• Removed deprecated support for custom EVP_CIPHER, EVP_MD, EVP_PKEY, and EVP_PKEY_ASN1 methods.

• Removed deprecated fixed SSL/TLS version method functions.

• Removed deprecated functions ERR_get_state(), ERR_remove_state() and ERR_remove_thread_state(). The ERR_STATE object is now always opaque.

• Dropped darwin-i386{,-cc} and darwin-ppc{,64}{,-cc} targets from Configurations.

This release adds the following new features:

• Support for Encrypted Client Hello (ECH, RFC 9849). See doc/designs/ech-api.md for details.

• Support for RFC 8998, signature algorithm sm2sig_sm3, key exchange group curveSM2, and [tls-hybrid-sm2-mlkem] post-quantum group curveSM2MLKEM768.

• cSHAKE function support as per SP 800-185.

• "ML-DSA-MU" digest algorithm support.

• Support for SNMP KDF and SRTP KDF.

• FIPS self tests can now be deferred and run as needed when installing the FIPS module with the -defer_tests option of the openssl fipsinstall command.

• Support for using either static or dynamic VC runtime linkage on Windows.

• Support for negotiated FFDHE key exchange in TLS 1.2 in accordance with RFC 7919.