OpenSSL openssl-3.0.22

openssl-3.0.22

OpenSSL 3.0.22

Security 6
  • Fixed heap buffer overflow in CMS key unwrapping
  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg
  • Fixed excessive memory use buffering DTLS records for a future epoch
  • Fixed CMP indefinite cache growth of extraCerts
  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher()
  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode

From OpenSSL

OpenSSL 3.0.22 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)

  • Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)

  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)

  • Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)

  • Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)

  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

View original

Upgraded? How did it go?

Discussion