OpenSSL Project Files

TLS/SSL and crypto library

This is an exact mirror of the OpenSSL Project project, hosted at https://github.com/openssl/openssl. SourceForge is not affiliated with OpenSSL Project.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
openssl-3.5.9.tar.gz	2026-09-29	53.3 MB	0
openssl-3.5.9.tar.gz.asc	2026-09-29	931 Bytes	0
openssl-3.5.9.tar.gz.sha1	2026-09-29	63 Bytes	0
openssl-3.5.9.tar.gz.sha256	2026-09-29	87 Bytes	0
OpenSSL 3.5.9 source code.tar.gz	2026-09-29	53.5 MB	0
OpenSSL 3.5.9 source code.zip	2026-09-29	57.1 MB	0
README.md	2026-09-29	2.7 kB	0
Totals: 7 Items		163.8 MB	0

OpenSSL 3.5.9 is a security patch release. The most severe CVE fixed in this release is High.

This release incorporates the following bug fixes and mitigations:

Fixed DTLS retransmissions of handshake messages from a stale buffer offset. (CVE-2026-84782)
Fixed excessive memory allocation in relative CRLDP processing. (CVE-2026-35189)
Fixed QUIC unvalidated amplification credit may be over-accounted. (CVE-2026-35191)
Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC. (CVE-2026-42772)
Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves. (CVE-2026-54872)
Fixed QUIC STREAM fragment metadata DoS. (CVE-2026-54873)
Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V. (CVE-2026-54875)
Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake. (CVE-2026-72897)
Fixed QUIC connection-level flow control was not enforced for streams. (CVE-2026-75804)
Fixed a NULL pointer dereference in CMP client revocation response handling. (CVE-2026-75805)
Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS. (CVE-2026-75806)
Fixed a timing side-channel in SM2 signature generation. (CVE-2026-77696)
Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack implementation. (CVE-2026-84784)
Fixed a bug where EVP_DecryptFinal() incorrectly reported a stale success on AES-SIV authentication failure.

Source: README.md, updated 2026-09-29

Other Useful Business Software

MongoDB Atlas runs apps anywhere Icon

MongoDB Atlas runs apps anywhere

Deploy in 115+ regions with the modern database for every enterprise.

MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.

Start Free

Veeam Data Platform v13.1 - Get Your Free Trial Icon

Veeam Data Platform v13.1 - Get Your Free Trial

Secure by design, portable by default. Recover clean, fast, anywhere. Start a free trial.

Try Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.

Try it Free

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Recommended Projects

wolfSSL
The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set. It works seamlessly in desktop, enterprise, and cloud environments as well. wolfSSL supports industry standards up to the current TLS 1.2 and DTLS 1.2, is up to 20 times smaller than OpenSSL, offers a simple API, an OpenSSL compatibility layer, OCSP and CRL support, is backed by the robust wolfCrypt cryptography library, and much more. wolfSSL relies on the FIPS 140-2 validated wolfCrypt library for all cryptographic functionality. Visit http://wolfssl.com/wolfSSL/fips.html for more info!
SimplePKI
A Public Key Cryptographic system based on OpenSSL and MySQL.
Hermes FTP Server
Hermes FTP Server is a free, cross-platform FTP server adhering to RFC 959, RFC 2228, and RFC 2389. It is being developed in Java with a strong focus on security and extensibility.
FreeNFS
Network File System (NFS Versions 2.0 & 3.0) for Windows
OpenSSL
This project offers OpenSSL for Windows (static as well as shared). It supports: FIPS Object Module 1.2 and CAPI engine. It includes most of the features available on Linux. It works out of the box so no additional software is needed.