Update to OpenSSL 4.0.2, a security patch release. The most severe CVE fixed is Moderate.

• Fixed QUIC server being able to trigger double free when processing INITIAL packet (CVE-2026-18798).
• Fixed heap buffer overflow in CMS key unwrapping (CVE-2026-63072).
• Fixed invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076).
• Fixed unbounded memory growth in QUIC server incoming channel queue (CVE-2026-14456).
• Fixed RPK server signature algorithm selection being able to dereference a missing certificate (CVE-2026-14457).
• Fixed excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874).
• Fixed client-side nemory leak in OCSP response checking (CVE-2026-54876).
• Fixed untrusted Sender DN being used as a format string in CMP response validation (CVE-2026-63073).
• Fixed CMP indefinite cache growth of extraCerts (CVE-2026-63074).
• Fixed QUIC ACK-only packet retention being able to cause memory exhaustion (CVE-2026-63075).
• Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher (CVE-2026-75803).
• Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.
• Updated compliance with TLS 1.3 session ticket lifetime requirements. TLS 1.3 clients now cap ticket_lifetime_hint to 7 days (604800 seconds) when processing new session ticket messages, in accordance with RFC 8446 Section 4.6.1.

Update to OpenSSL 4.0.1, a security patch release. The most severe CVE fixed is High.

• Fixed heap use-after-free in PKCS7_verify (CVE-2026-45447).
• Fixed CMS AuthEnvelopedData processing may accept forged messages (CVE-2026-34182).
• Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler (CVE-2026-34183).
• Fixed double-free when checking OCSP stapled response (CVE-2026-35188).
• Fixed NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764).
• Fixed AES-OCB IV ignored on EVP_Cipher path (CVE-2026-45445).
• Fixed possible heap buffer overflow in ASN.1 multibyte string conversion (CVE-2026-7383).
• Fixed out-of-bounds read in CMS password-based decryption (CVE-2026-9076).
• Fixed heap buffer over-read in ASN.1 content parsing (CVE-2026-34180).
• Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys (CVE-2026-34181).
• Fixed NULL dereference in certificate verification with OCSP Checking (CVE-2026-42765).
• Fixed possible NULL dereference in password-dased CMS decryption (CVE-2026-42766).
• Fixed NULL pointer dereference in CRMF EncryptedValue decryption (CVE-2026-42767).
• Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt and PKCS7_decrypt (CVE-2026-42768).
• Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate (CVE-2026-42769).
• Fixed FFC-DH peer validation uses attacker-supplied q (CVE-2026-42770).
• Fixed possible out of bounds read in X509_VERIFY_PARAM_set1_email (CVE-2026-42771).
• Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446).

First release, based on OpenSSL 4.0.0

Changes from YuOpenSSL-3.6:

New Features:

• Support for Encrypted Client Hello (ECH, RFC 9849).
• Support for RFC 8998, signature algorithm sm2sig_sm3, key exchange group curveSM2, and post-quantum group curveSM2MLKEM768.
• cSHAKE function support as per SP 800-185.
• “ML-DSA-MU” digest algorithm support.
• Support for SNMP KDF and SRTP KDF.
• Support for negotiated FFDHE key exchange in TLS 1.2 in accordance with RFC 7919.

Potentially Significant or Incompatible Changes:

• Removed extra leading '00:' when printing key data such as an RSA modulus in hexadecimal format where the first (most significant) byte is >= 0x80.
• Standardized the width of hexadecimal dumps to 24 bytes for signatures (to stay within the 80 characters limit) and 16 bytes for everything else.
• Added AKID verification checks when X509_V_FLAG_X509_STRICT is set.
• Augmented CRL verification process with several additional checks.
• OPENSSL_cleanup now runs in YuOpenSSL finalization section.
• Signatures of numerous API functions, including those that are related to X509 processing, are changed to include const qualifiers for argument and return types, where suitable.
• Deprecated X509_cmp_time, X509_cmp_current_time, and X509_cmp_timeframe in favor of X509_check_certificate_times.
• Removed support for the SSLv2 Client Hello.
• Removed support for SSLv3. SSLv3 has been deprecated since 2015, and OpenSSL had it disabled by default since version 1.1.0 (2016).
• Removed support for engines.
• Removed deprecated elliptic curves in TLS according to RFC 8422.
• Remove explicit EC curves.
• Removed BIO_f_reliable() implementation without replacement. It was broken since 3.0 release without any complaints.
• Removed deprecated support for custom EVP_CIPHER_, EVP_MD, EVP_PKEY, and [EVP_PKEY_ASN1]] methods.
• Removed deprecated fixed SSL/TLS version method functions.
• Removed deprecated functions ERR_get_state(), ERR_remove_state() and ERR_remove_thread_state().