openssl/apps, branch openssl-3.5

apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()

2026-10-24T10:05:34Z

The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071 (cherry picked from commit 0e2a7f23387cf7b7cd22832c1f5bdc1200683d6e)

Fix set but unsued variable in lib/opt.c

2026-10-12T07:50:42Z

https://github.com/openssl/openssl/actions/runs/34494520852/job/102982686286 CI is failing because we have a varaible in opt.c that is set but never used. Just remove it. Reviewed-by: Andrew Dinh Reviewed-by: Frederik Wedel-Heinen MergeDate: Sat Sep 12 13:18:16 2026 Reviewed-by: Mounir Idrassi Reviewed-by: Eugene Syromiatnikov Merged-from: https://github.com/openssl/openssl/pull/33194 (cherry picked from commit eadfce0e20dafd9a9bc8232caf84c4c9498ea667)

Fix a memory leak in apps/ocsp.c issuer

2026-09-15T16:35:41Z

Reviewed-by: Shane Lontis Reviewed-by: Paul Dale Reviewed-by: Paul Yang Merge-date: Tue Sep 15 16:28:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32807 (cherry picked from commit 3bdd4a655bd707f66a7ea620ffae88afc3e15fa7)

Copyright year updates

2026-08-25T11:54:36Z

Reviewed-by: Neil Horman Reviewed-by: Milan Broz MergeDate: Tue Aug 25 11:54:37 2026 Release: yes

Fix system resource leak in TerminalSocket()

2026-08-19T15:37:26Z

When establishing a terminal socket on OpenVMS, if the async I/O read operation (sys$qio) fails, the error path returns early without freeing the allocated channel via sys$dassgn. Add sys$dassgn(TerminalDeviceChan) in the sys$qio error path during creation. Also ensure dassgn executes regardless of whether sys$cancel succeeds during deletion to avoid exhausting the I/O channel quota. Reviewed-by: Nikola Pajkovsky Reviewed-by: Richard Levitte Merge-date: Wed Aug 19 15:37:03 2026 Merged-from: https://github.com/openssl/openssl/pull/30375 (cherry picked from commit ee7c64fbcd24276233d238aff1cdf9996be943cd)

apps: adjust stat usage to account for uplink

2026-07-08T09:55:40Z

Call stat() instead of fstat() when the FILE pointer provided by BIO_get_fp() is unavailable (as it may be the case in case of UPLINK builds). Signed-off-by: olszomal Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jul 8 09:47:42 2026 (Merged from https://github.com/openssl/openssl/pull/28172) (cherry picked from commit d2a9af2144ac2938619e44af3eaeaed3ea49cb05)

s_client: skip TCP shutdown drain for datagram protocols

2026-07-01T13:46:01Z

The shutdown-side drain uses a TCP half-close and a fixed 500 ms select() timeout to let peers consume buffered alerts before close. Running it for DTLS/QUIC datagram connections causes an unnecessary delay after the connection has otherwise completed. Limit this workaround to non-DTLS, non-QUIC connections. CLA: trivial Reviewed-by: Matt Caswell Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jul 1 13:35:53 2026 (Merged from https://github.com/openssl/openssl/pull/31558) (cherry picked from commit 5d61a36a9425c7615f9b8510967db330ee5ed6fc)

SSL_OP_SECOP is dead code

2026-06-30T10:55:23Z

Nothing set the "vfy" parameters in any of these functions to anything but 0. Remove the parameter and stage things related to SSL_OP_SECOP to go away in the future. Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 10:55:31 2026 (Merged from https://github.com/openssl/openssl/pull/31271)

Fix s_client Sieve STARTTLS response parsing

2026-06-17T16:23:06Z

Reviewed-by: Matt Caswell Reviewed-by: Nikola Pajkovsky MergeDate: Wed Jun 17 16:22:20 2026 (Merged from https://github.com/openssl/openssl/pull/31468) (cherry picked from commit 6ecdedbc65c9f2eca90a8ea7dc97e38372c48fe4)

apps/lib/apps.c: free retdb before return on OPENSSL_strdup() failure

2026-06-15T14:29:45Z

Fixes: c7d5ea2670c2 "Prepare to detect index changes in OCSP responder." Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs MergeDate: Mon Jun 15 14:29:23 2026 (Merged from https://github.com/openssl/openssl/pull/24981) (cherry picked from commit e4e5c0538e8e758dc3704d4788e1f0dff53aedf5)