Download Latest Version OpenSSL 4.0.1 source code.zip (59.0 MB)
Email in envelope

Get an email when there's a new version of OpenSSL Project

Home / openssl-4.0.1
Name Modified Size InfoDownloads / Week
Parent folder
openssl-4.0.1.tar.gz 2026-06-09 55.1 MB
0
openssl-4.0.1.tar.gz.asc 2026-06-09 833 Bytes
0
openssl-4.0.1.tar.gz.sha1 2026-06-09 63 Bytes
0
openssl-4.0.1.tar.gz.sha256 2026-06-09 87 Bytes
1 1 weekly downloads
OpenSSL 4.0.1 source code.tar.gz 2026-06-09 55.3 MB
0
OpenSSL 4.0.1 source code.zip 2026-06-09 59.0 MB
9 9 weekly downloads
README.md 2026-06-09 3.8 kB
1 1 weekly downloads
Totals: 7 Items   169.4 MB 11

OpenSSL 4.0.1 is a security patch release. The most severe CVE fixed in this release is High.

This release incorporates the following bug fixes and mitigations:

  • Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447)

  • Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182)

  • Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler. (CVE-2026-34183)

  • Fixed double-free when checking OCSP stapled response. (CVE-2026-35188)

  • Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)

  • Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445)

  • Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)

  • Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)

  • Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)

  • Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)

  • Fixed NULL dereference in certificate verification with OCSP Checking. (CVE-2026-42765)

  • Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)

  • Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767)

  • Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt(). (CVE-2026-42768)

  • Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate. (CVE-2026-42769)

  • Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770)

  • Fixed possible out of bounds read in X509_VERIFY_PARAM_set1_email(). (CVE-2026-42771)

  • Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)

  • Fixed a regression introduced in 4.0.0 that led to a openssl pkey command crash when it was invoked to encrypt a private key with password being provided interactively.

  • Fixed a regression introduced in 4.0.0 that led to openssl s_client -adv command prematurely terminating a session when reading input of 16384 bytes in one read() call.

Source: README.md, updated 2026-06-09