OpenSSL 4.0.3
2026-09-30T08:51:56Z•732acb00d4a1928db2843441b43d2e02b15746d839b6f30e3990eecf10afb150
CVE-2026-14456CVE-2026-14457CVE-2026-18798CVE-2026-35189CVE-2026-35191CVE-2026-42772CVE-2026-54872CVE-2026-54873CVE-2026-54874CVE-2026-54875CVE-2026-54876CVE-2026-63072CVE-2026-63073CVE-2026-63076CVE-2026-72897CVE-2026-75804CVE-2026-75805CVE-2026-84782CVE-2026-84783DTLSOpenSSLQUICTLSX.509certificate-processingcryptographic-librarydenial-of-servicememory-safetysecurity-updateside-channel
What happened
OpenSSL published security patch releases 4.0.3, 3.6.5, 3.5.9, and 3.4.8 on September 29, 2026. The releases address multiple high-severity issues affecting DTLS, QUIC, X.509, certificate processing, elliptic-curve cryptography, SM2, TLS handshakes, and CMP. Fixes include denial-of-service conditions, potential memory-safety vulnerabilities, timing side channels, and out-of-bounds access. Organizations using affected OpenSSL branches should upgrade to the corresponding patched release.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- openssl_releases
- Record identifier
- 732acb00d4a1928db2843441b43d2e02b15746d839b6f30e3990eecf10afb150
- Enrichment time
- 2026-09-30T08:51:56Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.