Commit 99068b5cc7 for openssl.org
commit 99068b5cc79307c52389afc39d87e6899305deea
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date: Mon Sep 28 16:44:12 2026 +0200
CHANGES.md, NEWS.md: update for 4.0.3
4.0.3 CHANGES.md includes the following:
* CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872,
CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804,
CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782,
CVE-2026-84783, CVE-2026-84784
* https://github.com/openssl/openssl/pull/31000
"Fix 4.0 regression: retain pending base64 BIO output on retry"
* https://github.com/openssl/openssl/pull/31610
"siv128.c: Assigned -1 to final_ret(ctx) variable on auth. failure."
* https://github.com/openssl/openssl/pull/32694
"http: reject HTTPS downgrades after relative redirects"
* https://github.com/openssl/openssl/pull/32872
"Remove /Gs0 windows compiler flag"
* https://github.com/openssl/openssl/pull/32941
"FIPS[4.0]: Change FIPS indicators so that all approved algorithms
have a gettable indicator"
4.0.3 NEWS.md includes the following:
* CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872,
CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804,
CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782,
CVE-2026-84783, CVE-2026-84784
* https://github.com/openssl/openssl/pull/31000
"Fix 4.0 regression: retain pending base64 BIO output on retry"
* https://github.com/openssl/openssl/pull/31610
"siv128.c: Assigned -1 to final_ret(ctx) variable on auth. failure."
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Merge-date: Tue Sep 29 12:00:20 2026
Reviewed-by: Milan Broz <mbroz@openssl.org>
Merged-from: https://github.com/openssl/openssl/pull/33052
diff --git a/CHANGES.md b/CHANGES.md
index e3e5c7e6c4..dedeab8b5c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -71,15 +71,6 @@ OpenSSL 4.2
*Dr Paul Dale*
- * Changed the OpenSSL FIPS provider so that every algorithm advertised with
- `fips=yes` explicitly exposes the `fips-indicator` as a gettable context
- parameter and returns 1 for an approved operation. The absence of an
- indicator is no longer interpreted as approval. Algorithms advertised
- with `fips=no`, including X448MLKEM1024, remain unapproved and return 0 when
- they expose the indicator.
-
- *Shane Lontis and Paul Dale*
-
* Added the `MLKEM512X25519` and `SecP256r1MLKEM512` hybrid TLS KEMs for the
newly assigned IANA codepoints per [draft-rosomakho-tls-ecdhe-mlkem512-00].
@@ -706,6 +697,324 @@ OpenSSL 4.1
OpenSSL 4.0
-----------
+### Changes between 4.0.2 and 4.0.3 [29 Sep 2026]
+
+ * Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
+
+ Severity: High
+
+ Issue summary: The DTLS retransmission logic does not correctly handle
+ a handshake message write that is suspended part-way through.
+ The retransmitted message can be read past the message buffer
+ and the retransmission overwrites the internal state the suspended write
+ needs to resume correctly.
+
+ Impact summary: The retransmitted message can disclose a heap memory
+ to the peer as plaintext handshake data or cause a crash and a Denial
+ of Service when the read reaches an unmapped memory region.
+
+ Reported by: Laurent Gaffie (secorizon.com).
+
+ ([CVE-2026-84782])
+
+ *Ryan Hooper*
+
+ * Fixed a use-after-free in X.509 extension cache under concurrent use.
+
+ Severity: Moderate
+
+ Issue summary: The first concurrent use of the same X.509 certificate
+ by several threads may cause its cached extension data to be freed
+ while another thread is still using it.
+
+ Impact summary: A remote, unauthenticated peer could crash a multi-threaded
+ TLS client, or a multi-threaded TLS server that requests client certificates,
+ if the first certificate chains built to the same trusted CA certificate
+ are built by several connections at the same time. This is a use-after-free
+ read, which is likely to crash the process, resulting in a Denial of Service.
+
+ Reported by: Tim Becker (Xint.io) and Aydın Mercan.
+
+ ([CVE-2026-84783])
+ <!-- https://github.com/openssl/openssl/pull/32614 -->
+
+ *Bob Beck*
+
+ * Fixed excessive memory allocation in relative CRLDP processing.
+
+ Severity: Low
+
+ Issue summary: A certificate with many `nameRelativeToCRLIssuer` CRL
+ distribution points causes disproportionate heap growth when OpenSSL caches
+ X.509 extensions.
+
+ Impact summary: Receiving a crafted certificate from a malicious peer
+ can lead to significant memory pressure and possible Denial of Service
+ in clients or in servers that solicit client certificates.
+
+ Reported by: Fuzz0x (ZKSC Institute of Security Research).
+
+ ([CVE-2026-35189])
+
+ *Viktor Dukhovni*
+
+ * Fixed QUIC unvalidated amplification credit may be over-accounted.
+
+ Severity: Low
+
+ Issue summary: The OpenSSL QUIC server, when configured to not preform
+ address validation, can be forced to count incoming packets multiple times
+ in its unvalidated credit computation, leading to a violation
+ of the [RFC 9000] unvalidated connection amplification limit of 3 times
+ the amount of data received.
+
+ Impact summary: A remote attacker, who is able to spoof packets to a server
+ using the OpenSSL QUIC implementation, might use the server
+ for an amplification of a Distributed Denial of Service attack.
+
+ Reported by: Ali Firas and Nikolas Gauder (NVIDIA).
+
+ ([CVE-2026-35191])
+
+ *Neil Horman*
+
+ * Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
+
+ Severity: Low
+
+ Issue summary: The QUIC stream reassembly algorithm performance deteriorates
+ progressively as packets are arriving out of order. The worst case has
+ a quadratic complexity, proportional to the number of stream frames kept
+ in the buffer for the received stream data.
+
+ Impact summary: A remote QUIC peer that completes the handshake can create
+ a connection-scoped CPU pressure and potentially a Denial of Service using
+ compliant `STREAM` frames inside the advertised receive window, with low
+ attacker bandwidth.
+
+ Reported by: Saku0512 and Opal Wright (Trail of Bits) in collaboration
+ with OpenAI
+
+ ([CVE-2026-42772])
+ <!-- https://github.com/openssl/openssl/pull/32771 -->
+
+ *Alexandr Nedvědický*
+
+ * Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
+
+ Severity: Low
+
+ Issue summary: The generic elliptic-curve scalar multiplication, used
+ for ECDSA and SM2 signature operations with curves that do not have
+ a dedicated implementation, leaks information about the secret nonce
+ through timing.
+
+ Impact summary: An attacker, who is able to measure signing times, may learn
+ information about the per-signature secret nonce, which over many signatures
+ can, via a Hidden Number Problem (lattice) attack, lead to recovery
+ of the private key.
+
+ Reported by: Alicja Kario and George Pantelakis (Red Hat), based
+ on the report of Youngjae Choi (Korea University).
+
+ ([CVE-2026-54872])
+
+ *Igor Ustinov*
+
+ * Fixed QUIC `STREAM` fragment metadata DoS.
+
+ Severity: Low
+
+ Issue summary: QUIC process may keep memory for QUIC packet buffer
+ for much longer period than necessary.
+
+ Impact summary: Remote peer can exploit this vulnerability by sending
+ maliciously crafted packets, making the local QUIC stack to keep the memory
+ for packet buffers allocated. The time for which the memory remains
+ allocated is entirely under the control of the potentially malicious remote
+ peer.
+
+ Reported by: Zhen Yan (AntAISecurityLab) and Bhabani Sankar Das.
+
+ ([CVE-2026-54873])
+ <!-- https://github.com/openssl/openssl/pull/32771 -->
+
+ *Alexandr Nedvědický*
+
+ * Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
+
+ Severity: Low
+
+ Issue summary: A non-constant-time optimized implementation of scalar
+ point multiplication is used for SM2 private key operations on ARM64
+ and RISC-V platforms.
+
+ Impact summary: An attacker able to measure the time taken by, or to observe
+ the cache-line access pattern of, SM2 signing or decryption on an affected
+ platform can learn information about the secret scalar.
+
+ Reported by: Abhinav Agarwal and Feng Xue.
+
+ ([CVE-2026-54875])
+
+ *Igor Ustinov*
+
+ * Fixed out-of-bounds access after `SSL_set_SSL_CTX()` during a handshake.
+
+ Severity: Low
+
+ Issue summary: A TLS server that calls `SSL_set_SSL_CTX()` to switch
+ a connection to a different `SSL_CTX` part way through a handshake may access
+ memory beyond the end of an internal array if the replacement context knows
+ about more provider signature algorithms than the context the connection was
+ created from. Applications that never call `SSL_set_SSL_CTX()`
+ are not affected.
+
+ Impact summary: A remote peer may be able to cause a small out-of-bounds
+ read, and, in some circumstances, a fixed-value out-of-bounds write,
+ on the server heap. This may lead to a Denial of Service.
+
+ Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
+ Brandon Luo, Luigino Camastra (Aisle Research), and Bhargava Shastry.
+
+ ([CVE-2026-72897])
+
+ *Matt Caswell*
+
+ * Fixed QUIC connection-level flow control was not enforced for streams.
+
+ Severity: Low
+
+ Issue summary: OpenSSL QUIC stack does not enforce connection-level flow
+ control for streams. Remote peers may send more bytes, as long as they fit
+ within the stream flow control limits.
+
+ Impact summary: A malicious remote peer may exploit the lack of connection
+ flow control for streams to make the QUIC stack receive ~100 MiB of memory
+ instead of 768 KiB (default flow control window size).
+
+ Reportedby: Moltenbit, Bhabani Sankar Das, Saiyowa Security Team, mzfr.
+
+ ([CVE-2026-75804])
+
+ *Alexandr Nedvědický*
+
+ * Fixed a NULL pointer dereference in CMP client revocation response handling.
+
+ Severity: Low
+
+ Issue summary: The OpenSSL Certificate Management Protocol (CMP) client
+ that requests a certificate revocation on the basis of a PKCS#10 CSR may
+ dereference a NULL pointer and terminate abnormally when processing a crafted
+ revocation response.
+
+ Impact summary: The NULL pointer dereference happens on a read, which
+ leads to a crash and a Denial of Service for the affected client application.
+
+ Reported by: Bhabani Sankar Das.
+
+ ([CVE-2026-75805])
+
+ *Bhabani Sankar Das and Norbert Pócs*
+
+ * Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
+
+ Severity: Low
+
+ Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
+ can be terminated by a single unauthenticated datagram whose encrypted
+ fragment is shorter than the mandatory explicit IV and authentication tag
+ overhead.
+
+ Impact summary: An attacker who can send a datagram that is routed
+ to an existing DTLS 1.2 association can tear that association down
+ without knowing any key material. This is a Denial of Service, limited
+ to the targeted association. There is no memory safety or confidentiality
+ impact.
+
+ Reported by: Mounir IDRASSI.
+
+ ([CVE-2026-75806])
+
+ *Mounir IDRASSI*
+
+ * Fixed a timing side-channel in SM2 signature generation.
+
+ Severity: Low
+
+ Issue summary: SM2 signature generation uses non-constant-time arithmetic
+ on secret values, forming a timing side-channel.
+
+ Impact summary: An attacker able to measure SM2 signing times may learn
+ information about the per-signature secret nonce, which over many signatures
+ can, via a Hidden Number Problem (lattice) attack, lead to recovery
+ of the private key.
+
+ Reported by: Vladimir Tokarev.
+
+ ([CVE-2026-77696])
+
+ *Igor Ustinov and Viktor Dukhovni*
+
+ * Fixed an unbounded `RETIRE_CONNECTION_ID` backlog in QUIC stack
+ implementation.
+
+ Severity: Low
+
+ Issue summary: A malicious remote peer may flood the local QUIC stack
+ with `NEW_CONNECTION_ID` frames by avoiding a limit check on how many
+ connection IDs the remote QUIC stack can use.
+
+ Impact summary: The local QUIC stack sends a `RETIRE_CONN_ID` frame
+ for every `NEW_CONNECTION_ID` frame it receives. The `RETIRE_CONN_ID`
+ frame is dispatched via the Control Frame Queue (CFQ). If the remote
+ peer also withholds ACKs, then it can force the local stack to allocate
+ up to ~400 MB (depending on ACK delay).
+
+ Reported by: Bhabani Sankar Das.
+
+ ([CVE-2026-84784])
+
+ *Alexandr Nedvědický*
+
+ * Fixed a bug where `EVP_DecryptFinal()` incorrectly reported a stale success
+ on AES-SIV authentication failure after a preciously successful message
+ decryption.
+ <!-- https://github.com/openssl/openssl/pull/31610 -->
+
+ *Abel Thomas*
+
+ * Fixed a regression in base64 encoding BIO filter introduced in OpenSSL 4.0,
+ where incomplete writes down the BIO chain may result in the loss of encoded
+ base64 data.
+ <!-- https://github.com/openssl/openssl/pull/31000 -->
+
+ *Mounir IDRASSI*
+
+ * Fixed a bug in `OSSL_HTTP_get()` that allowed to perform HTTPS-to-HTTP
+ downgrade through a relative redirect.
+ <!-- https://github.com/openssl/openssl/pull/32694 -->
+
+ *Mounir IDRASSI*
+
+ * Changed the OpenSSL FIPS provider so that every algorithm advertised
+ with `fips=yes` property explicitly exposes a `fips-indicator` gettable
+ context parameter, that returns 1 for an approved operation. The absence
+ of an indicator is no longer interpreted as approval. Algorithms advertised
+ with `fips=no` property, including X448MLKEM1024, remain unapproved
+ and return 0 when they expose the indicator.
+ <!-- https://github.com/openssl/openssl/pull/32941 -->
+
+ *Shane Lontis and Paul Dale*
+
+ * Changed the compiler flags supplied to MSVC targets to no longer include
+ `/Gs0` (resetting the minimum memory size occupied by local variables
+ for including stack probes to the default value of 4096), as it led
+ to mis-compilation of MD4 C implementation on ARM64.
+ <!-- https://github.com/openssl/openssl/pull/32872 -->
+
+ *Norbert Pócs*
+
### Changes between 4.0.1 and 4.0.2 [25 Aug 2026]
* Fixed QUIC server being able to trigger double free when processing `INITIAL`
@@ -24255,6 +24564,8 @@ ndif
[CVE-2026-34182]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34182
[CVE-2026-34183]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34183
[CVE-2026-35188]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35188
+[CVE-2026-35189]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35189
+[CVE-2026-35191]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35191
[CVE-2026-42764]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42764
[CVE-2026-42765]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42765
[CVE-2026-42766]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766
@@ -24263,17 +24574,29 @@ ndif
[CVE-2026-42769]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42769
[CVE-2026-42770]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42770
[CVE-2026-42771]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42771
+[CVE-2026-42772]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42772
[CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
[CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
[CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54872]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54872
+[CVE-2026-54873]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54873
[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-54875]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54875
[CVE-2026-54876]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54876
[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-72897]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-72897
[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
+[CVE-2026-75804]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75804
+[CVE-2026-75805]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75805
+[CVE-2026-75806]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75806
+[CVE-2026-77696]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-77696
+[CVE-2026-84782]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782
+[CVE-2026-84783]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84783
+[CVE-2026-84784]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84784
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
[RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
[RFC 3211]: https://datatracker.ietf.org/doc/html/rfc3211
@@ -24293,6 +24616,7 @@ ndif
[RFC 8452]: https://datatracker.ietf.org/doc/html/rfc8452
[RFC 8701]: https://datatracker.ietf.org/doc/html/rfc8701
[RFC 8998]: https://datatracker.ietf.org/doc/html/rfc8998#name-iana-considerations
+[RFC 9000]: https://datatracker.ietf.org/doc/html/rfc9000
[RFC 9147]: https://datatracker.ietf.org/doc/html/rfc9147
[RFC 9149]: https://datatracker.ietf.org/doc/html/rfc9149
[RFC 9846]: https://datatracker.ietf.org/doc/html/rfc9846
diff --git a/NEWS.md b/NEWS.md
index 97daa6ed74..87c04f9614 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -90,6 +90,63 @@ Known issues in 4.1.0
OpenSSL 4.0
-----------
+### Major changes between OpenSSL 4.0.2 and OpenSSL 4.0.3 [29 Sep 2026]
+
+OpenSSL 4.0.3 is a security patch release. The most severe CVE fixed
+in this release is High.
+
+This release incorporates the following bug fixes and mitigations:
+
+ * Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
+ ([CVE-2026-84782])
+
+ * Fixed a use-after-free in X.509 extension cache under concurrent use.
+ ([CVE-2026-84783])
+
+ * Fixed excessive memory allocation in relative CRLDP processing.
+ ([CVE-2026-35189])
+
+ * Fixed QUIC unvalidated amplification credit may be over-accounted.
+ ([CVE-2026-35191])
+
+ * Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
+ ([CVE-2026-42772])
+
+ * Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
+ ([CVE-2026-54872])
+
+ * Fixed QUIC `STREAM` fragment metadata DoS.
+ ([CVE-2026-54873])
+
+ * Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
+ ([CVE-2026-54875])
+
+ * Fixed out-of-bounds access after `SSL_set_SSL_CTX()` during a handshake.
+ ([CVE-2026-72897])
+
+ * Fixed QUIC connection-level flow control was not enforced for streams.
+ ([CVE-2026-75804])
+
+ * Fixed a NULL pointer dereference in CMP client revocation response handling.
+ ([CVE-2026-75805])
+
+ * Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
+ ([CVE-2026-75806])
+
+ * Fixed a timing side-channel in SM2 signature generation.
+ ([CVE-2026-77696])
+
+ * Fixed an unbounded `RETIRE_CONNECTION_ID` backlog in QUIC stack
+ implementation.
+ ([CVE-2026-84784])
+
+ * Fixed a bug where `EVP_DecryptFinal()` incorrectly reported a stale success
+ on AES-SIV authentication failure.
+
+ * Fixed a regression in base64 encoding BIO filter introduced in OpenSSL 4.0,
+ where incomplete writes down the BIO chain may result in the loss of encoded
+ base64 data.
+
### Major changes between OpenSSL 4.0.1 and OpenSSL 4.0.2 [25 Aug 2026]
OpenSSL 4.0.2 is a security patch release. The most severe CVE fixed
@@ -2559,6 +2616,8 @@ OpenSSL 0.9.x
[CVE-2026-34182]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34182
[CVE-2026-34183]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34183
[CVE-2026-35188]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35188
+[CVE-2026-35189]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35189
+[CVE-2026-35191]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35191
[CVE-2026-42764]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42764
[CVE-2026-42765]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42765
[CVE-2026-42766]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766
@@ -2567,17 +2626,29 @@ OpenSSL 0.9.x
[CVE-2026-42769]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42769
[CVE-2026-42770]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42770
[CVE-2026-42771]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42771
+[CVE-2026-42772]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42772
[CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
[CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
[CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54872]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54872
+[CVE-2026-54873]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54873
[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-54875]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54875
[CVE-2026-54876]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54876
[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-72897]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-72897
[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
+[CVE-2026-75804]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75804
+[CVE-2026-75805]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75805
+[CVE-2026-75806]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75806
+[CVE-2026-77696]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-77696
+[CVE-2026-84782]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782
+[CVE-2026-84783]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84783
+[CVE-2026-84784]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84784
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
[OpenSSL Guide]: https://docs.openssl.org/master/man7/ossl-guide-introduction
[README-QUIC.md]: ./README-QUIC.md