OpenSSL 4.0.2

OpenSSL security patch releases published on 2026-08-25 address multiple vulnerabilities across the 4.0, 3.6, 3.5, 3.4, and 3.0 branches. Issues include QUIC server double-free and memory exhaustion, CMS heap buffer overflow, CMP pointer dereference and format-string flaws, DTLS excessive memory use, OCSP memory leaks, and AEAD forgery conditions. The releases identify Moderate as the highest severity for the 2026-08-25 patches; related preceding releases OpenSSL 4.0.1, 3.6.3, and 3.5.7 addressed High-severity flaws including PKCS7 use-after-free and forged CMS messages. Organizations should].