| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| 4.0.7 source code.tar.gz | 2026-06-06 | 122.8 kB | |
| 4.0.7 source code.zip | 2026-06-06 | 367.0 kB | |
| README.md | 2026-06-06 | 757 Bytes | |
| Totals: 3 Items | 490.5 kB | 1 | |
Release Notes for 4.0.7
Security patch release (4.0.x).
Brings the security fixes up from 3.4.x (#652):
- PBES2-HS*+A*KW — bounded
p2c(PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82) - ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
- RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
- JWS —
algread only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)
Also included: