Fix possible use-after-free in OpenSSL PKCS7_verify()

Fixes CVE-2026-45447

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 20:22:50 2026

Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIV

AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext
Messages.

AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext
Messages on context reuse.

Fixes CVE-2026-45446

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 20:12:25 2026

Apply the buffered IV on the AES-OCB EVP_Cipher() path

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot,
processed input without flushing the buffered IV into the OCB
context.  Effective nonce was 0 regardless of the caller's IV;
EVP_*Final_ex() then emitted a tag depending only on (key, iv).
This gave (key, nonce) reuse and single-query universal forgery on
the EVP_Cipher() path.

Apply update_iv() at the head of aes_ocb_cipher() to mirror the
streaming handler.  The matching GCM one-shot does this already.

Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and
ChaCha20-Poly1305 in test/evp_extra_test.c.  Each cipher is
exercised with and without AAD; the no-AAD case is needed because
any prior EVP_CipherUpdate(NULL, aad, ...) routes through the
streaming handler and applies the IV itself, masking the bug.

Fixes CVE-2026-45445

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 20:02:00 2026

Add further unit tests for e-mail validation

Ensure we correctly catch misformed things.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 19:59:29 2026

Fix length miscalculation in validate_email

We incorrectly used the length of the domain part for the local part
when validating e-mail for X509_VERIFY_PARAM_set1_email().

Fixes CVE-2026-42771

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 19:59:28 2026

Match the local q DHX parameter against the peer's q

As FFC/DH peer public key validation uses the peer's q value instead
of checking against the local q, we must also check that these
q values match when setting the peer's public key.

Fixes CVE-2026-42770

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 19:56:27 2026

Use the correct issuer when validating rootCAKeyUpdate

This correctly uses the existing root, and not the same certificate
as the root of the chain to validate.

While we are here, we also turn on self signed certificate signature
checking as this case is actually bringing in trust anchors as
self signed certs, and fix a possible NULL deref.

Fixes CVE-2026-42769

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 19:54:01 2026

Enforce implicit rejection for CMS/PKCS#7 decryption

Drop the disablement of the implicit rejection for RSA PKCS#1 v1.5
decryption.

Fixes CVE-2026-42768

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 19:49:19 2026

Test for CVE-2026-42766

The script make_missing_kdf_der.py was developed by Mayank Jangid
and Kushal Khemka.

Co-Authored-by: Mayank Jangid <mayank.jangid.moon@gmail.com>
Co-Authored-by: Kushal Khemka <kushalkhemka559@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 18:57:53 2026

Fix potential NULL dereference processing CMS PasswordRecipientInfo

Avoid NULL dereferencing when keyDerivationAlgorithm is absent
in CMS PasswordRecipientInfo.

Fixes CVE-2026-42766

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 18:57:52 2026

Fix NULL Dereference in Certificate Verification with OCSP Checking

When performing OCSP response checking for certificates in the verification
chain, the code always tries to access the next certificate as the issuer.
There is a check for a self-signed certificate. However with the partial
chain verification enabled when the chain does not have a self-signed trusted
anchor, the issuer will be NULL for the last certificate in the chain. A NULL
pointer dereference then happens.

This issue affects only applications which enable both OCSP verification
of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial
chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate
verification. Both flags are disabled by default. For that reason, we have
assigned Low severity to the issue.

Fixes CVE-2026-42765

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 18:55:29 2026

Fix NULL dereference in QUIC address validation

QUIC server crashes when address validation (RFC 9000, Section 8.1)
is disabled and client sends initial packet with invalid token.

Issue reported and fix submitted by Sunwoo Lee (KENTECH),
Hyuk Lim (KENTECH) and Seunghyun Yoon (KENTECH)

Fixes CVE-2026-42764

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:50:48 2026

Fix Double-free When Checking OCSP Stapled Response

If OCSP stapling is enabled and the TLS client connects to a malicious server,
a crafted OCSP stapled response can trigger a double free in the TLS client
when the stapled response is checked.

The OCSP stapling is not enabled by default. Reliable code execution
through a double-free is technically complex and highly environment-dependent
but the Denial of Service impact is straightforward to achieve, warranting
Moderate severity.

Fixes CVE-2026-35188

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:44:58 2026

Add test for path challenge flood mitigation

client injects 16 path challenge frames. Those are received
by server. Only one challenge frame of 16 received triggers
path challenge response. Remaining challenge frames are
discrded/ignored.

Test introduces two counters to channel object:
  - path_challenge_rx which is bumped for every patch challenge
  frame received

  - path_response_tx which is bumped for every path response
  frame transmitted

Succesuful test verifies server receives 16 path challenge frames,
but sends just one path response frmae as response.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:35:21 2026

QUIC stack must limit the number of PATH_CHALLENGE frames processed in RX

Currently local QUIC stack allocates PATH_RESPONSE frame for every
PATH_CHALLENGE frame it receives in single packet from its remote peer.
The memory with PATH_RESPONSE frame is released after local QUIC stack
receives an ACK which confirms reception of PATH_RESPONSE by remote peer.
This gives remote peer too much control over memory resources local
QUIC stack may consume.

Quoting RFC 9000 section 9.2.1:
...an endpoint SHOULD NOT send multiple
PATH_CHALLENGE frames in a single packet.

Limiting the number of PATCH_CHALLENGE frames to 1 per QUIC packet received
helps to reduce heap memory overhead required to process PATH_CHALLENGE
frame.

Currently QUIC ACKM (ACK-manager) keeps all frames in retransmission
buffer until ACK is received. It can be changed such frames which
don't need to be ACKed don't need to be kept in retrans buffer,
those can be released right after transmission.

Fixes CVE-2026-34183

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:35:20 2026

Add tests for CVE-2026-34182

Test to ensure that for a given CMS message:

1) We do not allow the creation of a CMS message containing
   AuthEnvelopedData with a non-AEAD cipher.
2) We do not accept a message containing AuthEnvelopedData with a
   non-AEAD cipher specified in the AlgorithmIdentifier.
3) We do not allow tag lengths less that 4 bytes.

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:27:03 2026

Reject potentially forged encrypted CMS AuthEnvelopedData messages

1. Adjust ossl_cms_EncryptedContent_init_bio to not accept non-AEAD
ciphers.

If a forged CMS message with AuthEnvelopedData is received with
a non-AEAD cipher specified, we silently accept that and decrypt
the message, skipping any authentication, which violates RFC 5083.

We also add checks to ensure we fail if we try to encrypt
AuthEnvelopedData without using an AEAD cipher.

2. Ensure that tag lengths on cms AEAD data is the recommended size.

RFC 5084 recommends that mac tags be at least 12 bytes for AES-GCM
and 4 bytes for AES-CCM on AuthEnvelopedData. As this code is not
algorith-specific we add a check for a minimal size and just use the
lower limit which is sufficient to prevent this attack.

Without this check, its possible to set the tag length to 1 and within
256 guesses, forge a CMS message.

Fixes CVE-2026-34182

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:27:02 2026

pkcs12: verify that the pbmac1 key length is safe

Short mac keys (as short as 1 byte) can be used to probe the
system under attack to accept a PKCS#12 file created by an attacker
even if the attacker doesn't know the password used for MAC protection.

Fixes CVE-2026-34181

(also update the reference to the PBMAC1 PKCS#12 RFC)

Signed-off-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:18:59 2026

Avoid length truncation in ASN1_STRING_set

The ASN1_STRING_set() function takes an `int` length, make sure the
argument is not inadvertently truncated when it is called from
asn1_ex_c2i().

Fixes CVE-2026-34180

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:13:56 2026

cms: kek_unwrap_key: test for fix out-of-bounds read in check-byte validation

added EnvelopedData blob with a PasswordRecipientInfo using
id-alg-PWRI-KEK and an AES-128-CFB key encryption cipher. CFB's 1-byte
effective block size let the inlen >= 2 * blocklen guard in
kek_unwrap_key() accept a wrapped key shorter than the seven octets
the check-byte test reads from tmp[1..6]; the encryptedKey OCTET
STRING here is only two bytes.

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:06:38 2026

cms: kek_unwrap_key: Fix out-of-bounds read in check-byte validation

the check-byte test in kek_unwrap_key() reads tmp[1] through tmp[6]
unconditionally, so the decrypted buffer must hold at least seven
octets. The pre-decryption size check enforces inlen >= 2 * blocklen,
which yields the required seven octets only when blocklen >= 4. For
a KEK cipher with a smaller block size, inlen can be as small as
2 * blocklen and the check-byte read overruns the inlen-sized tmp
allocation.

Reject blocklen < 4 in the early sanity check. All block ciphers
appropriate for CMS PasswordRecipientInfo key wrapping have a block
size of at least 8 octets (DES/3DES = 8, AES = 16), so this only
forbids ciphers that would not be valid KEK choices anyway, and the
existing inlen >= 2 * blocklen check then guarantees the seven-octet
lower bound the check-byte test relies on.

Fixes CVE-2026-9076

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 14:06:36 2026

Reject oversized inputs in ASN1_mbstring_ncopy()

In ASN1_mbstring_ncopy() the destination size for BMPSTRING and
UNIVERSALSTRING output was computed by a signed left shift on an
int:

    outlen = nchar << 1;        /* MBSTRING_BMP  */
    outlen = nchar << 2;        /* MBSTRING_UNIV */

For nchar large enough the result is not representable in int.  In
the worst case (nchar == 0x40000000) nchar << 2 wraps to zero,
OPENSSL_malloc(1) is called, and traverse_string() then writes
4*nchar bytes into the one-byte allocation: a heap buffer
overflow.  The MBSTRING_UTF8 path computes outlen by summing
per-character byte counts in out_utf8(), and that sum can overflow
the same int under similarly large inputs.

Neither path is reachable from code that processes X.509
certificates through the DIRSTRING_TYPE mask used by
ASN1_STRING_set_by_NID(): UNIVERSALSTRING is absent from that
mask, and the UTF-8 sum requires inputs on the order of half a
gigabyte.  Reaching them needs an application that calls
ASN1_mbstring_copy()/ASN1_mbstring_ncopy() directly, or registers
a custom NID via ASN1_STRING_TABLE_add(), with an oversized
attacker-controlled input.

Add range checks before each shift and in out_utf8(), raising
ASN1_R_STRING_TOO_LONG at the point of detection.  Move the
existing ASN1_R_INVALID_UTF8STRING raise into out_utf8() too so
the two failure modes report distinct codes; the MBSTRING_UTF8
caller is left with cleanup only and now frees dest on error,
matching the BMP/UNIV branches.

Fixes CVE-2026-7383

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  8 14:02:18 2026

CMP: Optionally accept missing or non-matching transactionID or recipNonce values

This is done for error messages received if OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES
is set or the respective -nonmatched_error_nonces CLI option is given.

Can be helpful when the server (or other peer) cannot provide a proper error message header,
for instance if was unable to parse the ASN.1 encoding of a request message.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:49 2026
(Merged from https://github.com/openssl/openssl/pull/29043)

add HISTORY and CHANGES.md entry for OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR introduced in 4.0

Complements: 21722fe5545c "OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR: use new TA(s) for whole transaction (also pkiconf); update doc"

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:47 2026
(Merged from https://github.com/openssl/openssl/pull/29043)

OSSL_CMP_CTX_new.pod: fix HISTORY entry for OSSL_CMP_CTX_get0_geninfo_ITAVs() and OSSL_CMP_OPT_NO_CACHE_EXTRACERTS

Complements 8d9c8b3ff "CMP doc: add missing text on OSSL_CMP_OPT_NO_CACHE_EXTRACERTS to OSSL_CMP_CTX_new.pod and ossl_cmp_msg_check_update.pod"

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Jun 11 14:56:46 2026
(Merged from https://github.com/openssl/openssl/pull/29043)

doc: document SSL_set_*_state SSL argument

SSL_set_connect_state() and SSL_set_accept_state() have no return value to
report argument errors, but their documentation did not state the precondition
for the SSL argument. Passing NULL, or a pointer that is not a valid
SSL object, is a programmer error rather than a recoverable API error.
Document that the ssl argument must point to a valid SSL object and
must not be NULL.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Jun 11 09:04:23 2026
(Merged from https://github.com/openssl/openssl/pull/31435)

doc: document deprecated engine configure options

Document that no-engine, no-static-engine, and no-dynamic-engine
configure options are deprecated and do nothing. These options are
retained for backwards compatibility only.

Fixes #27473

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
MergeDate: Thu Jun 11 09:02:08 2026
(Merged from https://github.com/openssl/openssl/pull/29839)

uni2utf8: reject negative length like uni2asc

Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jun 11 08:56:39 2026
(Merged from https://github.com/openssl/openssl/pull/31378)

x509: check inner/outer signatureAlgorithm match in X509_CRL_verify

RFC 5280 section 5.1.1.2 requires the signatureAlgorithm in the outer
CertificateList wrapper to be identical to the signature field inside
the signed TBSCertList.  def_crl_verify() did not enforce this, unlike
X509_verify() and X509_ACERT_verify() which both carry an X509_ALGOR_cmp
guard.

Add the same guard to def_crl_verify().  A mismatch raises
X509_R_CRL_SIGNATURE_ALGORITHM_MISMATCH.  No known attack results from
the missing check; this is a conformance and hardening fix only.

Add a regression test: a CRL with a valid RSA-SHA256 signature over a
TBSCertList whose inner signatureAlgorithm claims ecdsaWithSHA256 is
now rejected.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Thu Jun 11 08:45:41 2026
(Merged from https://github.com/openssl/openssl/pull/31213)

convert CRYPTO_THREAD_run_once to use InitOnceExecuteOnce api

Issue #22059 reported a race condition in CRYPTO_THREAD_run_once on
windows platforms.  The most correct fix for this is to convert the
windows run_once implementation to use the Win32 InitOnceRunOnce
interface.  Doing so requires at least Windows Vista/Windows Server 2008
to be available, and because WinXP hasn't built since 3.0 released, it
seems sensible to bump our minimal NT version to be 0x600 (Vista/2008)

Also, while we're at it, this change caught a bad programming practice
in the rio_notifier code, which attempts to reset the once variable
during shutdown.  The windows static initalizer macro for this api is
constructed such that attempting to do so causes a build break.  Since
once variables are not meant to be reset (since they are only triggered
once), remove that reset code to avoid the breakage.

Note that this problem was independently found and fixed in #30198.
We're taking the fix from this pr (as they are effectively identical),
and using that PR to add some much needed tests to the rio code.

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Bob Beck <beck@openssl.org>
MergeDate: Wed Jun 10 19:44:19 2026
(Merged from https://github.com/openssl/openssl/pull/31339)

Fix parentheses in bn_cp_64 macro

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 13:24:46 2026
(Merged from https://github.com/openssl/openssl/pull/31386)

Fix macro staircase formatting issue

When the macro contains a comma (',') as a trailer character, then
clang-format doesn't get the correct formatting

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 13:24:44 2026
(Merged from https://github.com/openssl/openssl/pull/31386)

build: make enable-asan work for VC targets

Configure assumed GCC/Clang sanitizer spellings, so enable-asan was a
no-op on MSVC. Emit /fsanitize=address instead of -fsanitize=address
on VC targets.

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 12:53:11 2026
(Merged from https://github.com/openssl/openssl/pull/31366)

Consistenly zeroize public parameters based on OPENSSL_PEDANTIC_ZEROIZATION

Commit fa338aa7cd1e "fips: zeroization of public security parameters (PSPs)"[1]
introduced zeroization of public security params, which then[2] switched
its usage to OPENSSL_PEDANTIC_ZEROIZATION; however, zeroization has
implemented inconsistently, leaving out public security parameter
updates.  Consistently use newly introduced wrappers,
ossl_public_bn_free and ossl_public_param_free, for freeing such
parameters, and use them for FFC and RSA.

[1] https://github.com/openssl/openssl/pull/24355
[2] https://github.com/openssl/openssl/pull/26068

Complements: fa338aa7cd1e "fips: zeroization of public security parameters (PSPs)"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Jun 10 12:52:14 2026
(Merged from https://github.com/openssl/openssl/pull/31157)

Remove crypto/aes/aes_x86core.c because it's dead code

Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jun 10 12:43:39 2026
(Merged from https://github.com/openssl/openssl/pull/31424)

Let's attempt to make real documentation for X509_verify_cert

I am doing this because I have need to add information that really does
belong here, and the current stuff is less documentation than more or
less some hand waving about how it works without any details

So to summarize the changes:

1) This documents the current way that X509_verify_cert goes about
building and verifying a chain, identifying the relevant flags that
can affect how this happens today, and cross references the correct page
to find the rest of the exhaustive list of verification flags and what they do.

2) This documents the verification callback and how it can be used
to affect the verification outcome, This includes warning potential
users of the callback of what returning values from it means,
the common ways to end up unintentionaly doing things you did not expect
with the callback, and that it depends upon internals and should not be
relied upon.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:33:13 2026
(Merged from https://github.com/openssl/openssl/pull/31314)

quic: Add MFAIL coverage for stream map allocation and token caching

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:23:38 2026
(Merged from https://github.com/openssl/openssl/pull/31333)

quic: add lhash insert error checks

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:23:37 2026
(Merged from https://github.com/openssl/openssl/pull/31333)

crypto/evp: align exchange.c cleanup with kem/sig/asymcipher pattern

Commit a21f77d added explicit null assignments after EVP_KEYMGMT_free()
calls at the err:, legacy:, and success exit paths in kem.c,
asymcipher.c and signature.c.

The identical exit paths in evp_keyexch_init() (crypto/evp/exchange.c)
were not updated at the same time, leaving exchange.c as the only
outlier in the family without these null assignments.

This patch brings exchange.c into consistency with its sibling files
by adding exchange = NULL and tmp_keymgmt = NULL after each free at
the exit paths, matching the established pattern from a21f77d.

No functional change intended.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun 10 11:20:19 2026
(Merged from https://github.com/openssl/openssl/pull/31394)

doc: document OSSL_PKEY_PARAM_BITS meaning for each key type

The EVP_PKEY_get_bits() documentation states that "the definition
of cryptographic length is specific to the key cryptosystem" but
doesn't explain what this means for each key type.

Add a detailed list explaining what "bits" represents for RSA, DSA,
DH, EC, X25519, X448, Ed25519, Ed448, ML-DSA, SLH-DSA, and ML-KEM
key types to help users understand the return value.

Fixes #28337

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jun 10 11:15:17 2026
(Merged from https://github.com/openssl/openssl/pull/29790)

pvkfmt: check keylen before copying the BLOBHEADER

Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Jun 10 11:12:39 2026
(Merged from https://github.com/openssl/openssl/pull/31352)

Vectorize (inverse) NTT in ML-DSA

The vectorization is implemented using vector extensions (of gcc/clang)
and will work on any architecture with 128 bit vector registers that has
the builtin `vec_mulh` for the high part of a multiplication.

Enable this for s390x.

The speed-up factor on z17 is around 2--3.4.

Signed-off-by: Timo Keller <tkeller@linux.ibm.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 09:25:58 2026
(Merged from https://github.com/openssl/openssl/pull/30812)

ghash-armv4.pl: add missing alignment for gcm_gmult_4bit

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 07:51:21 2026
(Merged from https://github.com/openssl/openssl/pull/31327)

sha512-armv4: add missing function alignment

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 07:51:20 2026
(Merged from https://github.com/openssl/openssl/pull/31327)

armv4cpuid.pl: add missing function alignment

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 07:51:19 2026
(Merged from https://github.com/openssl/openssl/pull/31327)

aes-sha1-armv8.pl: add missing function alignment

Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun 10 07:51:17 2026
(Merged from https://github.com/openssl/openssl/pull/31327)

cmp_client_test.c: fix partly too generous total_timeout limit for IR session with polling

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Jun 10 06:46:36 2026
(Merged from https://github.com/openssl/openssl/pull/31111)

cmp_vfy.c: prevent needless and confusing duplication of diagnostic output on failure validating CMP messages

Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:39:00 2026
(Merged from https://github.com/openssl/openssl/pull/28986)

cmp_vfy.c: small fixes on content and layout of diagnostics on failure validating signature-based protection of CMP messages

Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:38:59 2026
(Merged from https://github.com/openssl/openssl/pull/28986)

make sure BIO_set_ssl() transfers ownership of ssl only on success; document this

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:27:04 2026
(Merged from https://github.com/openssl/openssl/pull/27357)

http_lib.c: add check that host_end is not past authority_end

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:27:03 2026
(Merged from https://github.com/openssl/openssl/pull/27357)

OSSL_HTTP_REQ_CTX.pod: tweak description of 'expect_asn1' parameter of OSSL_HTTP_REQ_CTX_set_expected()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:27:02 2026
(Merged from https://github.com/openssl/openssl/pull/27357)

apps/cmp.c: fix use of SSL_set_tlsext_host_name() for SNI and X509_VERIFY_PARAM_set1_host()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:27:00 2026
(Merged from https://github.com/openssl/openssl/pull/27357)

http_lib.c: fix parsing 'scheme' part in OSSL_parse_url()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:26:59 2026
(Merged from https://github.com/openssl/openssl/pull/27357)

SSL_CTX_set_tlsext_servername_callback.pod: improve doc of SSL_set_tlsext_host_name(); update format

Add recommendation to use it for TLS clients, together with X509_VERIFY_PARAM_{set1,add1}_host()

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun 10 06:26:57 2026
(Merged from https://github.com/openssl/openssl/pull/27357)

Disable tls test in pkcs11 provider

The head of the tree is broken due to a combined inability for openssl
and the provider to allow for duplication of MD contexts on an in flight
session

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:32 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

update pkcs11 submodule

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:30 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

clean up the code a bit

Remove some vestigual code from the property cache and name things
appropriately

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:28 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

Opportunistiaclly move archived items to a separate list

if a provider is unloaded and reloaded to a context, all its algorithms
get archived, making them un-look-up-able.  While this is good, having
all those effectively dead entries in the list slows down the linear
traversal in the lookup path, so periodically, while we have the write
lock held, migrate those entries to a separate archive list so that they
don't imact the normal hot path.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:26 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

Fix caching of EVP methods when NO_CACHED_FETCH is asserted

noticed during the debugging of this that, even though we may have
no-cached-fetch configured, we still put things in the method store,
which is wrong.

Don't cache things when we say we're not caching things

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:24 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

correct property_test

The duplicate property test has to change because we now archive QUERYs
instead of removing them immediately (i.e. we don't drop the ref count
until the store is freed).

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:21 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

Fix persniketyness in tsan

TSAN seems to be having a problem with atomic_load_ptr and
atomic_store_ptr.  Both are, by default, __ATOMIC_RELAXED operations.

According to the tsan docs, it flags these operations as a race because,
while they are indivisible, they create no happens-before constraint,
meaning they can be reordered.

An exemplar race that is reported is:

WARNING: ThreadSanitizer: data race (pid=2139404)
  Read of size 4 at 0x723400002308 by thread T39:
    #0 EVP_MD_up_ref crypto/evp/digest.c:995 (threadstest+0x45032d) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #1 evp_md_up_ref crypto/evp/digest.c:974 (threadstest+0x450242) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #2 ossl_method_up_ref crypto/property/property.c:201 (threadstest+0x4b7a55) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #3 ossl_method_store_cache_get_locked crypto/property/property.c:941 (threadstest+0x4b9922) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #4 ossl_method_store_cache_get crypto/property/property.c:974 (threadstest+0x4b9a47) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #5 inner_evp_generic_fetch crypto/evp/evp_fetch.c:314 (threadstest+0x458186) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #6 evp_generic_fetch crypto/evp/evp_fetch.c:404 (threadstest+0x4586dc) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #7 EVP_MD_fetch crypto/evp/digest.c:985 (threadstest+0x4502d7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #8 derive_kdk crypto/rsa/rsa_ossl.c:472 (threadstest+0x4cf738) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #9 rsa_ossl_private_decrypt crypto/rsa/rsa_ossl.c:646 (threadstest+0x4d0174) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #10 RSA_private_decrypt crypto/rsa/rsa_crpt.c:48 (threadstest+0x4c6971) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #11 rsa_decrypt providers/implementations/asymciphers/rsa_enc.c:321 (threadstest+0x51cab7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #12 EVP_PKEY_decrypt crypto/evp/asymcipher.c:280 (threadstest+0x44a9ca) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #13 thread_shared_evp_pkey test/threadstest.c:966 (threadstest+0x404be7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #14 thread_run test/threadstest.h:67 (threadstest+0x40132d) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)

  Previous write of size 8 at 0x723400002308 by main thread (mutexes: write M0):
    #0 memset <null> (libtsan.so.2+0x4c1eb) (BuildId: 40906101a3a1e1f1ececafafda314aee009d688a)
    #1 CRYPTO_zalloc crypto/mem.c:228 (threadstest+0x48679d) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #2 evp_md_new crypto/evp/digest.c:758 (threadstest+0x44f35e) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #3 evp_md_from_algorithm crypto/evp/digest.c:839 (threadstest+0x44f885) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #4 construct_evp_method crypto/evp/evp_fetch.c:230 (threadstest+0x457ec9) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #5 ossl_method_construct_this crypto/core_fetch.c:110 (threadstest+0x4801bf) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #6 algorithm_do_map crypto/core_algorithm.c:77 (threadstest+0x47f7a3) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #7 algorithm_do_this crypto/core_algorithm.c:122 (threadstest+0x47f987) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #8 ossl_provider_doall_activated crypto/provider_core.c:1609 (threadstest+0x49a42a) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #9 ossl_algorithm_do_all crypto/core_algorithm.c:164 (threadstest+0x47fb14) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #10 ossl_method_construct crypto/core_fetch.c:157 (threadstest+0x4803d0) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #11 inner_evp_generic_fetch crypto/evp/evp_fetch.c:333 (threadstest+0x4583a2) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #12 evp_generic_fetch crypto/evp/evp_fetch.c:404 (threadstest+0x4586dc) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #13 EVP_MD_fetch crypto/evp/digest.c:985 (threadstest+0x4502d7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #14 derive_kdk crypto/rsa/rsa_ossl.c:472 (threadstest+0x4cf738) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #15 rsa_ossl_private_decrypt crypto/rsa/rsa_ossl.c:646 (threadstest+0x4d0174) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #16 RSA_private_decrypt crypto/rsa/rsa_crpt.c:48 (threadstest+0x4c6971) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #17 rsa_decrypt providers/implementations/asymciphers/rsa_enc.c:321 (threadstest+0x51cab7) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)
    #18 EVP_PKEY_decrypt crypto/evp/asymcipher.c:280 (threadstest+0x44a9ca) (BuildId: f34377d95e3c1d13ab9aa3204d2f1f7840d1c84a)

What tsan is saying here is that the memset in evp_md_new may get
re-ordered such that the contents of the EVP_MD may still be getting
zeroed at the time we have (a) found the EVP_MD in the method store
cache, and (b) attempted to do an up_ref on it.

This is plainly impossible, especially given that, in order to reach the
method store cache, it must be places in the method store algorithm
sparse array, which still requires the taking of the method store write
lock.  But for some reason tsan fails to see the memory fence that
creates.

It seems the simplest solution to correct this is, if we are running
under tsan, use __ATOMIC_ACQUIRE and __ATOMIC_RELEASE on
CRYPTO_atomic_[load|store]_ptr to make sure tsan sees the proper memory
ordering.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:19 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

improve sharding of cache_lists

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:17 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

clean out lru list and write lock

We don't need either anymore

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:14 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

remove read lock from method store cache lookup

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:12 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

fully replace hash table with linked list

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:10 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

add atomic list removal to property cache

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:08 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

Add atomic list inserted to method store cache

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:05 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

remove ossl_method_store cache culling

Theres no point in thrashing the cache like this, it just gives us more
opportunities to dirty the cpu cache by taking the write lock

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 18:17:03 2026
(Merged from https://github.com/openssl/openssl/pull/31018)

Fix missing dependency on ml_kem_keymgmt.c

ml_kem_keymgmt.c includes der_wrap.h, which is a generated file, but
doesn't include a depdency in its build.info file, meaning that if the
dependencies aren't run in the right order, ml_kem_keymgmt.c gets
compiled before der_wrap.h is generated, leading to a build break.

Fix it by including the needed dependency.

Fixes #31379

Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jun  9 17:49:28 2026
(Merged from https://github.com/openssl/openssl/pull/31385)

Provide independent lock failure signal on cmp_exch_ptr

Our CRYPTO atomic api has a somewhat consistent problem in that its
possible in the case where locking fails to return an error while the
actual operation (store_int, store_ptr, etc), actually succeded.
cmp_exch is somewhat special here in that we may really need to know
independently if the function failed due to lock failure and if the
exchange occured (so we can know the output value of *expect).  Add a
separate parameter to allow callers to be informed of these statuses
independently.

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Jun  9 17:46:07 2026
(Merged from https://github.com/openssl/openssl/pull/31319)

apps/s_client.c: read one byte less to avoid triggerring overflow protection

Commit e0e276b50a1e "Fix a one byte buffer overflow in s_client" added
a check for the buffer size before adding a terminating \0, which led
to full reads of BUFSIZZ resulting in session termination.  Avoid that
by requesting one byte less.

Co-Autherd-by: Tomas Mraz <tomas@openssl.foundation>
Resolves: https://github.com/openssl/openssl/issues/30925
Fixes: e0e276b50a1e "Fix a one byte buffer overflow in s_client"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 09:12:53 2026
(Merged from https://github.com/openssl/openssl/pull/31413)

quic: cleanse derived IV on setup failure

el_build_keyslot() derives the QUIC IV before the success path stores
*out_iv_len. If a later step fails, the error cleanup currently uses
*out_iv_len and ends up cleansing zero bytes.

Cleanse the caller buffer using the local iv_len instead so the
derived IV is cleared on all post-derivation failure paths.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 08:53:50 2026
(Merged from https://github.com/openssl/openssl/pull/31346)

add fingerprint of the new PGP key

Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 08:27:39 2026
(Merged from https://github.com/openssl/openssl/pull/31353)

Check custom extensions are handled correct with 3rd party QUIC

We have some code to handle the case where we have custom 3rd party
extension and 3rd party QUIC. Test that this doesn't cause any problems.

Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 07:51:56 2026
(Merged from https://github.com/openssl/openssl/pull/31238)

There is no need to call custom_ext_copy_old_cb after reallocing dst->meths

In custom_exts_copy_conn we realloc'd the dst->meths buffer, and then
called `custom_ext_copy_old_cb` to transfer ownership of the all style
API wrapper allocations to the newly realloc'd buffer. But this makes
no sense. The buffer is realloc'd, and the old buffer is no longer freed,
so ownership of the old style API wrapper allocations transfer as well.
This is actually a use-after-free (we can no longer access the old buffer
once its been realloc'd), and also causes a leak. We just delete this
code.

Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 07:51:55 2026
(Merged from https://github.com/openssl/openssl/pull/31238)

Reapply "Preserve connection custom extensions in SSL_set_SSL_CTX()"

This reverts commit 7836b7d5b6a6b27a441c4e4c8564be6b270580c4.

Fixes #31193

Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 07:51:54 2026
(Merged from https://github.com/openssl/openssl/pull/31238)

aes_wrap: prevent crash on update without a key

EVP_CipherInit_ex2 with a NULL key followed by EVP_CipherUpdate
on AES-WRAP/WRAP-PAD/WRAP-INV ciphers dereferenced an uninitialised
function pointer because aes_wrap_init installs ctx->block only
when a key is supplied. aes_wrap_cipher_internal had no guard
before dispatching.

Track key state in ctx->key_set, matching OCB/CCM/GCM/Poly1305,
and refuse update if no key has been installed.

Added a regression test covering AES-256-WRAP, AES-256-WRAP-PAD
and AES-256-WRAP-INV.

CLA: trivial

Fixes: ca392b294359 "Add aes_wrap cipher to providers"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jun  3 11:52:05 2026
(Merged from https://github.com/openssl/openssl/pull/31292)

doc: Clarify SSL_CERT_DIR uses semicolon separator on Windows

The documentation for SSL_CERT_DIR stated that directories are
colon-separated, but on Windows the separator is semicolon.

Updated:
- openssl-rehash.pod.in: Added note about semicolon separator on Windows
- openssl-env.pod: Added note about multiple directories and Windows separator

Fixes: #27698
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Jun  3 11:44:35 2026
(Merged from https://github.com/openssl/openssl/pull/29894)

Provide ASN1_STRING_new_not_owned()

This function provides the ability to construct an ASN1_STRING
containing data that is not owned by the constructed ASN1_STRING. The
resulting ASN1_STRING, when freed, will not free the data, and it is
the caller's resposibility to ensure that the data lives past the
lifetime of any returned ASN1_STRING.

Why? you may ask? Many places where ->data and ->length were used
directly in the past before the opaquification of ASN1_STRING were
for this purpose, whether used for actual static data, or to turn
bytes created by and in control of the caller into an ASN1_STRING
for temporary use as an input. This function makes this easier
to do without making copies.

The function deliberately does not allow the creation of a BIT_STRING
as this would require also always providing unused bits, which is
annoying and unnecessary for almost all potential use cases.

For: https://github.com/openssl/openssl/issues/29861
For: https://github.com/openssl/openssl/issues/30162

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Jun  3 11:42:49 2026
(Merged from https://github.com/openssl/openssl/pull/30964)

quic: avoid one-byte over-read of conn close reason in copy_tcause

For a remote CONNECTION_CLOSE, src->reason points straight into the
received packet and holds exactly reason_len bytes with no guaranteed
trailing byte. copy_tcause() did OPENSSL_memdup(src->reason, l + 1),
reading one byte past the source. The +1 is only needed to make room
for the NUL written at r[l], so allocate l + 1 but copy only the l
valid bytes.

Fixes: 40c8c756c86f "QUIC APL/CHANNEL: Wire up connection closure reason"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Wed Jun  3 11:39:47 2026
(Merged from https://github.com/openssl/openssl/pull/31349)

Remove unused crl_dir setting from config files

The crl_dir setting in CA_default section is not used anywhere. Remove
it from the example config and test configs, update the VMSify-conf.pl
path conversion script to no longer reference it, and regenerate
openssl-vms.cnf.

Fixes #31103

CLA: trivial

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Wed Jun  3 11:37:02 2026
(Merged from https://github.com/openssl/openssl/pull/31215)

statem: fix missing fatal if valid_flags mfail in process cert req

It is a contract of tls process functions to trigger fatal error if they
fail. This is not being done in checking result of s->s3.tmp.valid_flags
allocation. If this happens, it triggers alert in read_state_machine()
for READ_STATE_BODY state that calls this process function. It calls
check_fatal() if MSG_PROCESS_ERROR is returned and the assert in it
fails because no error is triggered.

The fix just adds the fatal and also uses MSG_PROCESS_ERROR macro as
return value instead of hard coded 0.

Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Wed Jun  3 11:33:33 2026
(Merged from https://github.com/openssl/openssl/pull/31338)

crypto/hpke/hpke_util: Fixes redundant mdname is valid check.

Removed the redundant `mdname` is not NULL check.

Fixes #31299

Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Jun  3 11:30:09 2026
(Merged from https://github.com/openssl/openssl/pull/31321)

Fix broken hex data by reformatting

The clang format broke some data in hexadecimal format.  To make the tool
obedient, the trailing comma needs to be removed, then it interpretes
the data differently and therefore does not reformat it.  The format can
then be changed to the correct form.

Fixes: https://github.com/openssl/project/issues/1959
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Jun  3 07:46:14 2026
(Merged from https://github.com/openssl/openssl/pull/31350)

rsa_sig: reject short buffers in raw verify_recover

The md==NULL path of rsa_verify_recover passed the caller buffer to
RSA_public_decrypt without checking routsize, while the X9.31 and PKCS#1
paths already reject undersized output buffers. RSA_public_decrypt writes
up to RSA_size() bytes, so a short rout overflows. Validate routsize
against RSA_size() before the call.

Fixes: 6f4b7663150e "PROV: add RSA signature implementation"
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Tue Jun  2 11:55:00 2026
(Merged from https://github.com/openssl/openssl/pull/31340)

doc: Add a missing comma in -traditional option explanation.

CLA: trivial

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
MergeDate: Tue Jun  2 11:48:05 2026
(Merged from https://github.com/openssl/openssl/pull/31342)

test: fix unreachable code in test_kdf_pbkdf2_large_output in evp_kdf_test.c

The condition `if (sizeof(len) > 32)` was intended to set `len` to
SIZE_MAX on platforms where size_t can hold values larger than 32 bits.
However, sizeof() returns the size in bytes, not bits. Since sizeof(size_t)
is typically 4 or 8 bytes on all current platforms, the condition was
always false, leaving len at 0 and skipping the large-output test.

This commit fixes the check by comparing SIZE_MAX directly against
0xFFFFFFFFU, which correctly detects whether size_t can represent
values exceeding 32-bit range. This ensures the test properly validates
PBKDF2 behavior when requested output length is excessively large.

Fixes: 1cae59d14b9e "Make KDFs fail if requesting a zero-length key."
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Daniel Kubec <kubec@openssl.foundation>
MergeDate: Tue Jun  2 11:10:23 2026
(Merged from https://github.com/openssl/openssl/pull/31344)

s390x: Selectively re-format s390xcap.c

The clang formatter made some code places unreadable.  Selectively revert
the formatting to how it was before the re-formatting, and mark those places
with '/* clang-format off */' so that it does not get reformatted again.

While at it, change it to use designated initializers allowed with C-99.

No functional change intended.

Resolves: https://github.com/openssl/openssl/issues/31247
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 07:49:58 2026
(Merged from https://github.com/openssl/openssl/pull/31263)

poly1305: prevent crash on final without a key

EVP_MAC_init with a NULL key followed by EVP_MAC_final on a
Poly1305 context crashed with a NULL function-pointer dispatch
because poly1305_init accepted the no-key case as success, and
poly1305_final had no guard before dispatching through the
uninitialised Poly1305 state.

Add a key_set field to struct poly1305_data_st (matching
OCB/CCM/GCM), set it in poly1305_setkey, and refuse init and
final if no key has been installed.

Added a regression test asserting EVP_MAC_init with a NULL key
returns 0.

##### Checklist
- [ ] documentation is added or updated
- [x] tests are added or updated

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 07:35:02 2026
(Merged from https://github.com/openssl/openssl/pull/31298)

quic: fix keyslot cctx leak by not checking EL state in teardown

el_teardown_keyslot() decided whether to free a keyslot by calling
ossl_qrl_enc_level_set_has_keyslot() against the EL's current state.
On error paths the state does not yet match the slots that were
provisioned, so the check returned 0 and the cctx and iv were leaked.

The fix drops the state check and rely on the existing cctx != NULL
check which is sufficient for all callers of el_teardown_keyslot().

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Jun  1 07:32:33 2026
(Merged from https://github.com/openssl/openssl/pull/31323)

ktls: Fix invalid memory access on retry with moving write buffer

kTLS write is using application buffer always without a memory copy.
And it completely ignores SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER as a
result.  If the user frees or re-uses the original buffer and retries
the send on SSL_ERROR_WANT_WRITE, the code will read and send the data
from the original already freed buffer sending whatever happens to be
in that memory now and corrupting the message, potentially crashing
the application as well.

Fix by making a copy if we can't send the whole thing right away and
the moving write buffer is configured.

This preserves the zero-copy semantics for the happy path and avoids
the invalid memory access and data corruption when retry is necessary.
The copy is done in the common code as it is hard to preserve the
zero-copy behavior otherwise.

Test is added that reproduces the issue.  It may be possible to modify
the existing kTLS test to conditionally enable the modes and do the
BIO swap, but it feels like the issue deserves a separate one.

The test doesn't rely on any specific cypher or TLS version, so only
one combination is checked, but it should be enough.

There is no TLS_BUFFER_set_len() and the original kTLS code never
sets it, so not setting it on the copy either for now.

Fixes: 50ec750567e0 "ssl: Linux TLS Tx Offload"
Fixes #21202

Assisted-by: claude-opus-4.6
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 07:29:13 2026
(Merged from https://github.com/openssl/openssl/pull/31146)

ssl: avoid integer overflow by casting sum terms to size_t and not the result

Avoid possible integer overflow:  instead of casting the sum to size_t,
each operand of the sum is cast to size_t before addition to avoid int
overflow.

Signed-off-by: Herman Semenoff <GermanAizek@yandex.ru>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 07:24:21 2026
(Merged from https://github.com/openssl/openssl/pull/30972)

crypto, ssl: fix printf formats according to param types

inttypes.h is also used for more accurate compatibility with all
platforms, as it is the more correct choice according to C standard.

Signed-off-by: Herman Semenoff <GermanAizek@yandex.ru>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 06:58:24 2026
(Merged from https://github.com/openssl/openssl/pull/30969)

apps: fix printf formats according to param types

inttypes.h is also used for more accurate compatibility with all
platforms, as it is the more correct choice according to C standard.

Signed-off-by: Herman Semenoff <GermanAizek@yandex.ru>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 06:58:23 2026
(Merged from https://github.com/openssl/openssl/pull/30969)

ossl_store.pod: add reference to the 'org.openssl.winstore' scheme

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 04:57:22 2026
(Merged from https://github.com/openssl/openssl/pull/25683)

SSL_CTX_set1_verify_cert_store.pod: extend list of SEE ALSO references

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 04:57:19 2026
(Merged from https://github.com/openssl/openssl/pull/25683)

doc/man3/*.pod: fix doc cert_store vs. chain_store/verify_store and PEM format

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 04:57:17 2026
(Merged from https://github.com/openssl/openssl/pull/25683)

apps/*.c,doc/man1/*.pod.in: fix doc and error output of cert_store vs. chain_store/verify_store and PEM format

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 04:57:15 2026
(Merged from https://github.com/openssl/openssl/pull/25683)

openssl-rehash.pod.in: fix details of the general description how input files are handled

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Jun  1 04:57:12 2026
(Merged from https://github.com/openssl/openssl/pull/25683)