OpenSSL Project Files

TLS/SSL and crypto library

This is an exact mirror of the OpenSSL Project project, hosted at https://github.com/openssl/openssl. SourceForge is not affiliated with OpenSSL Project.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
openssl-4.0.2.tar.gz	2026-08-25	55.2 MB	2
openssl-4.0.2.tar.gz.asc	2026-08-25	931 Bytes	0
openssl-4.0.2.tar.gz.sha1	2026-08-25	63 Bytes	0
openssl-4.0.2.tar.gz.sha256	2026-08-25	87 Bytes	1
OpenSSL 4.0.2 source code.tar.gz	2026-08-25	55.3 MB	0
OpenSSL 4.0.2 source code.zip	2026-08-25	59.1 MB	13
README.md	2026-08-25	2.4 kB	0
Totals: 7 Items		169.6 MB	16

OpenSSL 4.0.2 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

Fixed QUIC server being able to trigger double free when processing INITIAL packet. (CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking. (CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)
Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)
Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

Source: README.md, updated 2026-08-25

Other Useful Business Software

MongoDB Atlas runs apps anywhere Icon

MongoDB Atlas runs apps anywhere

Deploy in 115+ regions with the modern database for every enterprise.

MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.

Start Free

$300 Free Credits to Build on Google Cloud Icon

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Recommended Projects

wolfSSL
The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight, portable, C-language-based SSL/TLS library targeted at IoT, embedded, and RTOS environments primarily because of its size, speed, and feature set. It works seamlessly in desktop, enterprise, and cloud environments as well. wolfSSL supports industry standards up to the current TLS 1.2 and DTLS 1.2, is up to 20 times smaller than OpenSSL, offers a simple API, an OpenSSL compatibility layer, OCSP and CRL support, is backed by the robust wolfCrypt cryptography library, and much more. wolfSSL relies on the FIPS 140-2 validated wolfCrypt library for all cryptographic functionality. Visit http://wolfssl.com/wolfSSL/fips.html for more info!
SimplePKI
A Public Key Cryptographic system based on OpenSSL and MySQL.
Hermes FTP Server
Hermes FTP Server is a free, cross-platform FTP server adhering to RFC 959, RFC 2228, and RFC 2389. It is being developed in Java with a strong focus on security and extensibility.
FreeNFS
Network File System (NFS Versions 2.0 & 3.0) for Windows
OpenSSL
This project offers OpenSSL for Windows (static as well as shared). It supports: FIPS Object Module 1.2 and CAPI engine. It includes most of the features available on Linux. It works out of the box so no additional software is needed.