openssl, branch openssl-3.4.8

Prepare for release of 3.4.8

2026-09-29T14:13:05Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 14:13:05 2026 Release: yes

make update

2026-09-29T14:13:05Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 14:13:05 2026 Release: yes

Copyright year updates

2026-09-29T14:11:12Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 14:11:12 2026 Release: yes

CHANGES.md, NEWS.md: update for 3.4.8

2026-09-29T12:03:21Z

3.4.8 CHANGES.md includes the following: * CVE-2026-35189, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72896, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84784 * https://github.com/openssl/openssl/pull/32872 "Remove /Gs0 windows compiler flag" 3.4.8 NEWS.md includes the following: * CVE-2026-35189, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72896, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84784 Signed-off-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Norbert Pocs Merge-date: Tue Sep 29 12:03:25 2026

test verifies the connection level RX flow control

2026-09-29T11:58:42Z

window is enforced. Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Reviewed-by: Andrew Dinh Merge-date: Tue Sep 29 11:58:46 2026

CVE-2026-75804 QUIC connection-level flow control not enforced, remote memory exhaustion

2026-09-29T11:58:42Z

Function ossl_quic_rxfc_get_error() must also report flow control violation error for connection level not just for stream level. Ignoring connection level error prevents QUIC stack to enforce flow control. Fixes CVE-2026-75804 Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Reviewed-by: Andrew Dinh Merge-date: Tue Sep 29 11:58:45 2026

CVE-2026-84784 QUIC: unbounded RETIRE_CONNECTION_ID backlog (memory DoS)

2026-09-29T11:33:05Z

Currently the cur_retire_prior_to counter is updated when RETIRE_CONNECTION_ID is dispatched to control frame queue. However to follow protocol state at both connection ends the counter must be updated after seeing an ACK from remote peer indicating it's received RETIRE_CONNECTION_ID frame. Diverging from protocol spec here allows malicious remote peer to queue excessive amount of RETIRE_CONNECTION_ID frames to local control frame queue (CFQ). Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 11:33:10 2026

sm2: make sm2_sig_gen() constant time

2026-09-29T11:26:35Z

After fixing CVE-2025-9231, sm2_sig_gen() still used variable-time BN_mod_mul() and BN_sub() on private key and nonce material. This commit makes it fully constant time. Fixes CVE-2026-77696 Co-authored-by: Viktor Dukhovni Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alicja Kario Reviewed-by: Viktor Dukhovni Merge-date: Tue Sep 29 11:26:40 2026

ec: make ossl_ec_scalar_mul_ladder() scalar padding constant time

2026-09-29T11:26:35Z

Fixes CVE-2026-54872 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Alicja Kario Reviewed-by: Viktor Dukhovni Merge-date: Tue Sep 29 11:26:39 2026

Add regression tests for the SSL_set_SSL_CTX() sigalg state

2026-09-29T11:22:58Z

The fix for CVE-2026-72897 made SSL_set_SSL_CTX() refresh the connection's signature algorithm state so that it describes the context being installed. Cover it. That state is sized from the SSL_CTX SSL_new() was called on, and a provider sigalg's sig_idx is its position in the list of whichever SSL_CTX a peer codepoint is resolved against, so the two have to describe the same context. The test provider makes them differ: a context created before it is loaded lacks the two slots it adds, and one created afterwards has them. Three routes an application can switch context from are covered, and they do not behave alike. test_sigalg_ctx_switch() switches from the servername and client_hello callbacks, both of which run before tls1_set_server_sigalgs() allocates valid_flags. A stale slot count undersized that allocation, and tls1_process_sigalgs() then read and wrote past its end. The two callbacks run at different points - the client_hello callback before the ClientHello extensions are parsed at all, the servername callback from the final pass over them - so they are checked separately. The extra provider sigalgs are TLSv1.3 only, so only those cases reached past the end of the buffer; the TLSv1.2 cases pin the invariant. test_sigalg_ctx_switch_cert_cb() switches from the certificate callback, which runs after valid_flags has been sized and filled in. Nothing recomputes the shared sigalgs later in the same handshake, so nothing read out of bounds on that route, but the state left behind was inconsistent. It also checks the built-in slots survive the switch, which is the only coverage of that part of the change. test_sigalg_ctx_switch_reneg() switches during a TLSv1.2 renegotiation with a changed servername. valid_flags is allocated by the initial handshake and not freed in between, so this is the case where the buffer has to be replaced rather than merely sized correctly later. Each test checks the premise it depends on rather than risk becoming vacuous: that the replacement context really does have more slots, that the renegotiation really was a full handshake, and that the flags being compared across the switch were non-zero to begin with. Assisted-by: Claude Code:claude-opus-5[1m] Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Merge-date: Tue Sep 29 11:23:00 2026