openssl/include, branch openssl-3.6.4

Copyright year updates

2026-08-25T11:46:17Z

Reviewed-by: Neil Horman Reviewed-by: Milan Broz MergeDate: Tue Aug 25 11:46:18 2026 Release: yes

Avoid double free of qrx in port_default_packet_handler()

2026-08-24T15:49:29Z

port_default_packet_handler() may perform double free of qrx when channel creation fails. The port_default_packet_handler() transfers ownership of qrx to channel/connection via call to port_bind_channel(). The port_bind_channel() however may release the qrx when channel can not be bound. The error is then detected in port_default_packet_handler() which then agains releases qrx for the second time. The fix is to add a reference counter to QRX object so transfer of ownership between port_default_packet_handler() and QUIC_CHANNEL can be handled safely. Fixes CVE-2026-18798 Reviewed-by: Igor Ustinov Reviewed-by: Andrew Dinh Merge-date: Mon Aug 24 15:47:02 2026

Don't store ACK-only frames in TX history for QUIC.

2026-08-24T12:13:24Z

When QUIC sends an ACK-only frame, there is no expectation that the peer will ack that ack (i.e. it is itself not ack-eliciting). However, our implementation stores these frames in the TX history regardless. In and of itself thats ok, but if a malicious client establishes a connection, and then drives the connection such that ack-only frames are forced from the peer (i.e. by sending numerous ping frames), and then withholding any subseqent acks for ack-eliciting data, like legitimate data, said malicious client can force inappropriate memory growth on the server, leading to potential DOS attacks. Don't store any ACK-only frames in the TX history to address this. Record it in our TX history so that the send window moves forward appropriately, but for ack-only frames, immediately remove it, since we don't expect to get an ack for them anyway. Initially authored by Opal Wright The initial proposal had some shortcommings in which the highest pn acked value was not accounted for which I have fixed with the assistance of Claude Assisted-by: Anthopic Sonnet 5 Fixes CVE-2026-63075 Reviewed-by: Saša Nedvědický Reviewed-by: Bob Beck Merge-date: Mon Aug 24 12:13:31 2026

test/quicapitest.c: add test for pending connections limit enforcement

2026-08-12T17:28:40Z

This is a regression test for CVE-2026-14456. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Andrew Dinh Reviewed-by: Neil Horman MergeDate: Wed Aug 12 15:00:30 2026 (Merged from https://github.com/openssl/openssl/pull/32052) (cherry picked from commit 0461a5636deca9af034db70ff017ad1138836c8c)

QUIC server: limit number of pending QUIC channels/connections

2026-08-12T17:14:24Z

Currently, there is no limit for pending QUIC connections. The port default packet handler creates channel for every valid initial packet which does belong to existing channel (a.k.a. connection). The newly created channel is inserted to list of pending channels where it waits to be accepted by local application by call to SSL_accept_connection(3ossl). This change introduces a limit for pending connection. The pending queue is limited to 256 pending connections. Applications may change the limit by calling SSL_set_feature_request_uint(3ossl) on SSL server listener object with configurable value SSL_VALUE_QUIC_MAX_PENDING_CONNS. Fixes: CVE-2026-14456 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Andrew Dinh Reviewed-by: Neil Horman MergeDate: Wed Aug 12 15:00:25 2026 (Merged from https://github.com/openssl/openssl/pull/32052) (cherry picked from commit 9416706d408bb84deb7cee4647bff3045d2dc7ba)

Add ossl_list_TYPE_join(head, tail) function

2026-08-06T11:58:40Z

The function appends list tail to list head. List tail becomes empty after the function returns. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Thu Aug 6 11:58:45 2026 (Merged from https://github.com/openssl/openssl/pull/32031)

SSL_OP_SECOP is dead code

2026-06-30T10:54:49Z

Nothing set the "vfy" parameters in any of these functions to anything but 0. Remove the parameter and stage things related to SSL_OP_SECOP to go away in the future. Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 10:54:54 2026 (Merged from https://github.com/openssl/openssl/pull/31271)

include/internal/hashtable.h: avoid OOB read in ossl_ht_strcase()

2026-06-24T13:13:13Z

Avoid accessing src[len] by swapping the check order and bound check the iterator variable before the access. Found by cppcheck. Fixes: cc4ea5e00028 "Introduce new internal hashtable implementation" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman Reviewed-by: Paul Dale MergeDate: Wed Jun 24 13:09:25 2026 (Merged from https://github.com/openssl/openssl/pull/31663) (cherry picked from commit 029d629db23e95c6e827d09dae89ee8b4b54f3e2)

x509: check inner/outer signatureAlgorithm match in X509_CRL_verify

2026-06-11T08:49:34Z

RFC 5280 section 5.1.1.2 requires the signatureAlgorithm in the outer CertificateList wrapper to be identical to the signature field inside the signed TBSCertList. def_crl_verify() did not enforce this, unlike X509_verify() and X509_ACERT_verify() which both carry an X509_ALGOR_cmp guard. Add the same guard to def_crl_verify(). A mismatch raises X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH. No known attack results from the missing check; this is a conformance and hardening fix only. Add a regression test: a CRL with a valid RSA-SHA256 signature over a TBSCertList whose inner signatureAlgorithm claims ecdsaWithSHA256 is now rejected. Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Thu Jun 11 08:49:42 2026 (Merged from https://github.com/openssl/openssl/pull/31213)

Copyright year updates

2026-06-09T11:44:35Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 11:44:36 2026 Release: yes