openssl/ssl/ssl_lib.c, branch master

Cache decoded certs on client in CTX to avoid multiple asn1 parsing

2026-10-21T16:44:28Z

our TLS client path has to do an ASN1 decode on every new connection it establishes. Other TLS stacks (notably rustls) seems to not do this decode, opting instead to to do just enough der parsing to verify the certificate chain. We can't really do that, but we can maybe do some things to speed up this path. Most notably we can cache the received certificate der string in the SSL_CTX along with a previously decoded X509 certificate to avoid the overhead of additional ASN1 parsings in future connections Reviewed-by: Bob Beck Reviewed-by: Nikola Pajkovsky Merge-date: Wed Oct 21 16:44:29 2026 Merged-from: https://github.com/openssl/openssl/pull/33085

ssl: handle session ID cache lock failure

2026-10-21T16:24:43Z

SSL_has_matching_session_id() returns 0 both when no matching session exists and when the cache lock cannot be acquired. Its use in the built-in generator's retry loop and the final uniqueness check can therefore treat a lock failure as proof that no conflict exists. Add an internal tri-state lookup. The final uniqueness check uses it as a backstop for IDs produced by both built-in and application callbacks, recording an internal fatal error when the cache cannot be checked. The retry loop also uses it to prevent the built-in generator from returning an ID after its own lookup failed, through the existing callback failure path. Preserve the public API's boolean contract. Correct the callback-selection cache lock failure reason from SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED to ERR_R_INTERNAL_ERROR. Remove a redundant caller-side SSLfatal() that appended a generic ERR_R_INTERNAL_ERROR after the specific error already recorded. Add a deterministic unit test for final cache lookup failure. Fixes #32358 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy Merge-date: Wed Oct 21 16:25:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32359

Removes clean DES and RC2 as encryption methods for TLS ciphersuites and refactors the fetching of NULL cipher to be consistent.

2026-10-21T16:22:53Z

Reviewed-by: Mounir Idrassi Reviewed-by: Dmitry Belyavskiy Merge-date: Wed Oct 21 16:22:59 2026 Merged-from: https://github.com/openssl/openssl/pull/32051

DTLS: Fix listener cleanup after failed SSL_clear

2026-10-21T15:41:42Z

SSL_clear() temporarily detaches an accepted connection's listener association while replacing its DTLS state. If initialization fails, unregister the saved peer before releasing the receive queue and listener reference. Otherwise, freeing the connection leaves a stale entry in the listener's established-connection table. Build the temporary unregister key in stack storage so removal does not depend on a successful allocation during cleanup. Share the key serialization with registration and lookup, preserving the existing peer-address matching and SipHash inputs. Add allocation-failure tests for SSL_clear() on an accepted DTLS 1.2 connection. Cover both single failures and sustained allocation failure through reset cleanup. Check that detached connections are removed, while connections retaining their listener association stay registered. Fixes: #32974 Assisted-by: OpenCode:github-copilot/gpt-6-astra Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Mounir Idrassi Merge-date: Wed Oct 21 15:41:49 2026 Merged-from: https://github.com/openssl/openssl/pull/33270

Don't report held-back DTLS app data as readable in SSL_poll()

2026-10-21T09:21:35Z

ossl_dtls_conn_poll_events() reported SSL_POLL_EVENT_R whenever SSL_has_pending() was true. For DTLS that includes records in buffered_app_data, which dtls1_read_bytes() only releases once the handshake has finished. In DTLS 1.3 the sender of a KeyUpdate stays in init until it is ACKed. If the peer sends application data without ACKing, e.g.: 1. Server sends KeyUpdate, enters TLS_ST_SW_KEY_UPDATE. 2. Client sends a record before reading the KeyUpdate. 3. Server's SSL_read() buffers the record, returns WANT_READ. then every SSL_poll() returns at once with SSL_POLL_EVENT_R and every SSL_read() returns SSL_ERROR_WANT_READ. An event loop spins until the ACK arrives or the KeyUpdate retransmissions run out (483s). The same happens to a client, and in DTLS 1.2 for data received between ChangeCipherSpec and Finished. Only count buffered_app_data once the handshake has finished, and otherwise wait for incoming datagrams as usual. Discovered by Anthropic's OSS Scanner (finding ANT-2026-QCQMEE2S). Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Mounir Idrassi Reviewed-by: Ryan Hooper Merge-date: Wed Oct 21 09:21:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33262

DTLS 1.3: only accept plaintext alerts once the hellos are done

2026-10-20T12:38:12Z

DTLS 1.3 defers installing the handshake read keys until the peer's first epoch 2 record arrives. Until then the read record layer stays in epoch 0 and accepted plaintext handshake and ACK records. A peer that never sends an epoch 2 record could therefore send its Finished in plaintext. That Finished was checked with a finished key that was never derived (all zero), and the connection completed with its application read keys numbered epoch 1 instead of 3. From that state a client can ACK only the second NewSessionTicket and then send a record claiming epoch 2. The server performs the deferred key change on the established connection, and dtls1_clear_sent_buffer() on the partly acknowledged queue leaves a freed item linked in sent_messages, which is a use-after-free. A malicious server can do the same to a client. Once the hellos are done, tell the epoch 0 read layer that only plaintext alerts may still arrive, and discard any handshake fragments buffered before then. Make tls_process_finished() refuse a DTLS 1.3 Finished read before the handshake keys are installed. Disarm the deferred key change once it has run, and reset it with the connection. DTLS 1.3 has not been in any final release, so no released version of OpenSSL is affected. Discovered by Anthropic's OSS Scanner (finding ANT-2026-YZ5U4MXB). Assisted-by: Claude Code:claude-opus-5-5 Reviewed-by: Tomas Mraz Reviewed-by: Mounir Idrassi Reviewed-by: Daniel Kubec Merge-date: Tue Oct 20 12:38:20 2026 Merged-from: https://github.com/openssl/openssl/pull/33256

Removes redundant SSLv3 version checks and check against TLS1_VERSION_MAJOR instead of SSL3_VERSION_MAJOR.

2026-10-02T07:27:06Z

Reviewed-by: Andrew Dinh Reviewed-by: Mounir Idrassi Merge-date: Fri Oct 2 07:28:05 2026 Merged-from: https://github.com/openssl/openssl/pull/31823

ssl_lib.c: Add NULL checks for SSL_CONNECTION_FROM_SSL_ONLY() return

2026-09-29T16:34:13Z

There are 2 places where sc is not checked for NULL before using it. This adds the checks. Reviewed-by: Dmitry Belyavskiy Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz Merge-date: Tue Sep 29 16:35:03 2026 Merged-from: https://github.com/openssl/openssl/pull/31397

Fix DTLS listener reset races

2026-09-29T16:24:39Z

Keep listener drive guards and the RX queue alias in SSL_CONNECTION so concurrent listener threads do not access resettable DTLS state during SSL_clear(). Check stable state before d1 and clear the RX alias before freeing its queue. Add focused multithreaded coverage for both SSL_clear() paths and run the race tests in ThreadSanitizer CI. Incorporates changes from #32962. Fixes #32948 Fixes #32949 Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Mounir Idrassi Reviewed-by: Ryan Hooper Merge-date: Tue Sep 29 16:24:45 2026 Merged-from: https://github.com/openssl/openssl/pull/32964

Fix out-of-bounds valid_flags access after SSL_set_SSL_CTX()

2026-09-29T11:20:16Z

SSL_new() sizes the connection-local signature algorithm state from the SSL_CTX the connection was created from: sc->ssl_pkey_num counts the built-in certificate slots plus one for each of that context's provider TLS-SIGALG entries, and s3.tmp.valid_flags is later allocated to match. SSL_set_SSL_CTX() installs a duplicate of the replacement context's CERT but leaves both of those describing the original context. Peer signature algorithm codepoints are subsequently resolved against the replacement context, where a provider sigalg's sig_idx is simply its position in that context's list. If the replacement context advertises more provider sigalgs than the original, a codepoint occupying one of the excess slots yields an index past the end of valid_flags. The usual route is a switch from the servername callback, which runs before tls1_set_server_sigalgs() allocates the buffer: the stale ssl_pkey_num undersizes the allocation, and tls1_process_sigalgs() then reads one 4-byte word past the end for each such codepoint the peer offered, and writes CERT_PKEY_EXPLICIT_SIGN|CERT_PKEY_SIGN where that word already reads zero. The peer chooses how many of these accesses occur, and at which offsets, by selecting which codepoints to send. Refresh ssl_pkey_num from the newly installed CERT and, where a valid_flags buffer already exists, replace it with one sized for that context. A count which is too large is wrong in the same way as one that is too small: loops bounded by ssl_pkey_num index cert->pkeys, which the replacement context sizes. The replacement buffer is allocated before the point at which the switch is committed, so that a failure can still be reported rather than leaving the connection half switched. The built-in slots are copied across rather than zeroed. They may already hold peer signature algorithm state which is not derived from the SSL_CTX, and nothing recomputes it after a context switch: at TLS 1.2 and above tls1_check_chain() only ORs CERT_PKEY_SIGN and CERT_PKEY_EXPLICIT_SIGN in from the existing value, and ssl_set_masks() needs them to enable ECDSA, Ed25519 and Ed448. Zeroing them makes a TLSv1.2 handshake with an ECDSA certificate fail with "no shared cipher". The provider slots are positional and context specific, so they are reset. Fixes CVE-2026-72897 Assisted-by: Claude Code:claude-opus-5[1m] Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Merge-date: Tue Sep 29 11:20:18 2026