Workaround Uplink compilation for MINGW 32bit

The uplink code breaks compilation with strict warnings
for MINGW (only for 32-bit).
  error: ISO C forbids conversion of object pointer
  to function pointer type [-Werror=pedantic]
or
  error: ISO C forbids assignment between function pointer
  and 'void *' [-Werror=pedantic]

and some other missing declarations and prototypes.

As uplink.h is included in cryptlib.h and used in BIO
code, using a pragma to disable warnings would touch
to much code.

With (uintptr_t) cast, it silences cast warnings with gcc.

For the rest of the code, just disable warnings, as this
code would need to be rewritten and heavily retested
on older systems.
NOTE: applink.c is INCLUDED from uplink.h.

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Apr 28 16:02:22 2026
(Merged from https://github.com/openssl/openssl/pull/30963)

Fix always false comparison in asn1/a_strex.c

On 32bit platforms, some compilers like clang
produce this warning
   error: result of comparison 'unsigned long' > 4294967295
   is always false [-Werror,-Wtautological-type-limit-compare]
   70 |     if (c > 0xffffffffL)

Just compare it to UNICODE_MAX here.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Tue Apr 28 16:01:04 2026
(Merged from https://github.com/openssl/openssl/pull/30962)

test: move 'Simple single-stream test' from quic_multstream to quic-radix

unlike multistream test, which uses t-server, the radix tests
use regular SSL objects, thus radix tests execute production code.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Apr 28 12:35:42 2026
(Merged from https://github.com/openssl/openssl/pull/30913)

Make SSL_get_stream_write_state() safe for concluded streams

QUIC stack may panic when application calls SSL_get_stream_write_state()
on cocluded QUIC stream onject. The sequence of action which leads
to NULL pointer dereference is as follows:
  - application uses SSL_stream_conclude(ssl_stream, 0) to conclude
    the stream (let remote peer know no to expect more data)

  - application uses SSL_get_stream_write_state(ssl_stream)
    to query stream state.

If underlying sstream object is gone by the time when
SSL_get_stream_wtite_state() is called, then application
may see NULL pointer dereference. The underlying sstream
object is freed when FIN sent on beahalf of SSL_stream_conclude()
is ACKed by remote peer.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Apr 28 12:35:41 2026
(Merged from https://github.com/openssl/openssl/pull/30913)

FIPS: Add HMAC key size compliance check to the MAC legacy bridge.

The hmac fips provider implementation used by the EVP_MAC API handles key
size checks, but it only does the test for the internal case.
Previously HMAC was implemented using EVP_DigestSign related functions,
and these are implemented using a mac_legacy_sig bridge, because of this
the MAC is external. For external cases the caller is responsible for
doing any key checks, so a FIPS indicator has been added.

Reported-by: https://github.com/taha2samy
Fixes: #30012
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Apr 28 07:13:24 2026
(Merged from https://github.com/openssl/openssl/pull/30150)

Fix record layer leak when swapping chained transport BIO

tls_set1_bio() freed only the top BIO (BIO_free). Use BIO_free_all so
a pushed transport chain is released when the record layer replaces
its BIO.

Add test_ssl_set_wbio_chain_no_leak in sslapitest (stacked BIO chain
via SSL_set0_wbio) per reviewer feedback on GH openssl#30483. Drop the
Perl s_client reconnect recipe and CHANGES entry (internal leak only).

Fixes #30458

Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Tue Apr 28 06:39:25 2026
(Merged from https://github.com/openssl/openssl/pull/30483)

Add property method cache failure tests

Add coverage for duplicate property cache insertion and
allocation-failure handling in the property method cache.

The memfail exerciser covers cache set, providerless cache deletion,
providerless cache rebuild, and cleanup of method references when
cache insertion fails.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Apr 28 06:33:15 2026
(Merged from https://github.com/openssl/openssl/pull/30891)

Fix property method cache insert failure handling

Treat method-cache hash table inserts as successful only when they
return 1. This handles allocation/grow failures distinctly from
successful replacement and avoids using temporary QUERY entries after
failed insertion.

Separate cleanup for unlinked temporary QUERY objects from linked
cache entries, and release both the pending cache reference and
caller-visible method reference when deferred providerless cache
insertion fails.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Apr 28 06:33:15 2026
(Merged from https://github.com/openssl/openssl/pull/30891)

ssl/quic/quic_port.c: fix leak in port_make_channel()

Free pre-existing ch->qlog_title before OPENSSL_strdup to avoid
leaking the value allocated in ossl_quic_channel_alloc(). Use
ossl_quic_channel_free() on strdup failure to ensure proper cleanup.

Solves https://github.com/openssl/openssl/issues/30440

Fixes #30440

Signed-off-by: huanghuihui0904 <625173@qq.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Mon Apr 27 07:21:11 2026
(Merged from https://github.com/openssl/openssl/pull/30441)

Add icx compiler version support in perl asm scripts

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Apr 27 06:44:52 2026
(Merged from https://github.com/openssl/openssl/pull/30313)

move contents of HACKING.md to a doc/HOWTO

reference list of files and removed -Werror from instructions on adding
functions rename HACKING.md to HOWTO.md.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 27 06:14:57 2026
(Merged from https://github.com/openssl/openssl/pull/18003)

Increase the query cache insert grow retry

On s390x, the distribution of the query cache hash values is different
compared to other architectures, probably because of endianess and pointer
alignment being different (the hash key contains pointer values and integers).
This leads to the fact that ossl_ht_cache_QUERY_insert() is not always able to
add a query during the FIPS selftests, and thus ossl_ht_cache_QUERY_insert()
returns -1 is such cases.

Increase the number of retries inside ossl_ht_insert() to at least the
number elements per neighborhood plus 1. With this it is able to grow the
hash table enough so that the queries used during the FIPS selftest can
all be added to the hash table, even on s390x.

There is still no guarantee that the number of retries is enough for all
possible queries. It can still happen that certain queries can't be added to
the cache, even on other architectures. This does not really hurt, such
queries will just not be cached and are freshly fetched again the next time.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Mon Apr 27 05:56:53 2026
(Merged from https://github.com/openssl/openssl/pull/30903)

crypto/hashtable/hashtable.c: fix hashtable grow cleanup for aligned allocation

Update grow_hashtable cleanup to free the neighborhood allocation
through newmd->neighborhood_ptr_to_free instead of newmd->neighborhoods.

Fixes: cc4ea5e00028 "Introduce new internal hashtable implementation"
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 14:26:08 2026
(Merged from https://github.com/openssl/openssl/pull/30859)

Handle NULL-buffer size probe in ossl_param_build_set_bn_pad()

ossl_param_build_set_bn_pad() is reached by two distinct caller
populations.  When an OSSL_PARAM_BLD template is supplied
(bld != NULL), the template allocates backing storage internally and
no caller-side sizing is required.  When an explicit OSSL_PARAM[]
array is supplied (bld == NULL), the caller follows the standard
OSSL_PARAM size-probe contract: invoke the primitive once with
p->data == NULL to learn the required size via p->return_size, then
allocate a buffer of that size and invoke again with the real
storage.

The bld == NULL branch did not honour the size-probe contract: with
p->data == NULL and a non-zero sz it fell through to
OSSL_PARAM_set_BN() and raised CRYPTO_R_TOO_SMALL_BUFFER, so callers
could never discover the required size.

The defect has been latent across several releases.  This primitive
is the *padded* BN setter: it emits a fixed-width encoding regardless
of the BN's actual magnitude, which is needed for the private key --
a minimal encoding would leak its bit-length through timing or
allocation side channels.  In practice the private key is the only
provider parameter that reaches this primitive.  Callers that want
private-key material have historically done so through
EVP_PKEY_todata() and its OSSL_PARAM_BLD template path, where the
bug is invisible.  EVP_PKEY_get_params() callers exist but have not
previously needed the private-key BN.  Any caller that does request
it on the explicit-params path -- whether by name or as part of
iterating a provider's full gettable list -- now sees the probe
behave as it does elsewhere.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Sun Apr 26 13:35:32 2026
(Merged from https://github.com/openssl/openssl/pull/30942)

remove ossl_quic_detach_stream() and ossl_quic_attach_stream()

Those function used to be backends for SSL_attach_stream() and
SSL_detach_stream(). Both those functions were removed from
API back 2023. And it does not look like there is a plan
to revive them. This PR removes implementation of stream detach/attach
functions with their tests.

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 13:26:58 2026
(Merged from https://github.com/openssl/openssl/pull/30956)

CHANGES.md, NEWS.md: updates for 4.0.0 final release

NEWS.md is amended to include the following PRs:
 * https://github.com/openssl/openssl/pull/28305
   "Replace homebrewed implementation of *printf*() functions with libc"
 * https://github.com/openssl/openssl/pull/29299
   "Remove support for custom EVP_CIPHERs"
 * https://github.com/openssl/openssl/pull/29366
   "Remove support for custom EVP_MDs"
 * https://github.com/openssl/openssl/pull/29384
   "Remove support for custom EVP_PKEY_METHODs"
 * https://github.com/openssl/openssl/pull/30128
   "Removes fixed version TLS methods."
 * https://github.com/openssl/openssl/pull/29405
   "Remove support EVP_PKEY_ASN1_METHODs from the public API"

Overall, CHANGES.md includes the following:
 * https://github.com/openssl/openssl/pull/8136
   "Remove spurious '00:' printing RSA/DSA/DH/EC key material with leading bit
   set in unsigned BN"
 * https://github.com/openssl/openssl/pull/17495
   "4.0: `X509_ALGOR_set_md()`: Add return value to indicate success or failure"
 * https://github.com/openssl/openssl/pull/18229
   "public API: Remove needless `const` from scalar types"
 * https://github.com/openssl/openssl/pull/22304
   "4.0: crypto/{CMS,PKCS7,OCSP,TS,X509}: constify cert list parameters"
 * https://github.com/openssl/openssl/pull/24551
   "Enable RFC 7919 FFDHE groups for TLS 1.2 server"
 * https://github.com/openssl/openssl/pull/24738
   "add ech-api.md"
 * https://github.com/openssl/openssl/pull/25193
   "ECH build artefacts and a bit of code"
 * https://github.com/openssl/openssl/pull/25420
   "ECH CLI implementation"
 * https://github.com/openssl/openssl/pull/25663
   "ECH external APIs"
 * https://github.com/openssl/openssl/pull/25991
   "preserve data constness when getting issuer name's and subject's hash"
 * https://github.com/openssl/openssl/pull/26011
   "ECH client side"
 * https://github.com/openssl/openssl/pull/27397
   "create SSL_listen_ex api"
 * https://github.com/openssl/openssl/pull/27431
   "fips: Enforce lower bounds checks for password protected files when using
   FIPS providers, by default"
 * https://github.com/openssl/openssl/pull/27540
   "ECH client sending mulitple key shares"
 * https://github.com/openssl/openssl/pull/27561
   "ECH both sides now"
 * https://github.com/openssl/openssl/pull/27776
   "Introduce the PACKET_msg_start() function"
 * https://github.com/openssl/openssl/pull/28033
   "Constify further X509 functions; remove OSSL_FUTURE_CONST"
 * https://github.com/openssl/openssl/pull/28041
   "Remove support for SSLv2 Client Hello"
 * https://github.com/openssl/openssl/pull/28108
   "Add a way to cleanse params arrays"
 * https://github.com/openssl/openssl/pull/28160
   "New options for reading MAC key from environment variable, file and standard
   input were added."
 * https://github.com/openssl/openssl/pull/28270
   "s_client and s_server command line options for ECH (plus some wndows
   CI fixes)"
 * https://github.com/openssl/openssl/pull/28278
   "Implementing store support for EVP_SKEY"
 * https://github.com/openssl/openssl/pull/28305
   "Replace homebrewed implementation of *printf*() functions with libc"
 * https://github.com/openssl/openssl/pull/28432
   "Add support for CSHAKE."
 * https://github.com/openssl/openssl/pull/28445
   "Updated s_server's verify_return_error option to enable peer verification"
 * https://github.com/openssl/openssl/pull/28535
   "Print PowerPC CPUINFO"
 * https://github.com/openssl/openssl/pull/28623
   "Combining time validation with comparison return values considered harmful"
 * https://github.com/openssl/openssl/pull/28837
   "Add support to serialize/deserialize digest state for export/import"
 * https://github.com/openssl/openssl/pull/29018
   "CRL: Validate Certificate Issuer extension with IDP Indirect=TRUE"
 * https://github.com/openssl/openssl/pull/29057
   "Avoid empty AKID/SKID extensions in CSRs and certs"
 * https://github.com/openssl/openssl/pull/29107
   "CRL: Enforce proper handling of ASN1_TIME validation results"
 * https://github.com/openssl/openssl/pull/29116
   "info: Print CPUINFO for SPARCv9 processors"
 * https://github.com/openssl/openssl/pull/29152
   "Add new public API for checking certificate times."
 * https://github.com/openssl/openssl/pull/29187
   "Remove the ASN1_STRING_FLAG_X509_TIME flag"
 * https://github.com/openssl/openssl/pull/29195
   "Add SNMPKDF implementation"
 * https://github.com/openssl/openssl/pull/29200
   "Add tests and documentation and fix some issues resulting"
 * https://github.com/openssl/openssl/pull/29206
   "Per-key encoding formats for ML-KEM and ML-DSA"
 * https://github.com/openssl/openssl/pull/29222
   "Implementation of Deferred FIPS Self-Tests"
 * https://github.com/openssl/openssl/pull/29223
   "ML-DSA: Add a digest that can calculate external mu."
 * https://github.com/openssl/openssl/pull/29230
   "doc/man3: Add OPENSSL_ppccap.pod
 * https://github.com/openssl/openssl/pull/29266
   "make PEM hexdump width a multiple of 8 bytes"
 * https://github.com/openssl/openssl/pull/29299
   "Remove support for custom EVP_CIPHERs"
 * https://github.com/openssl/openssl/pull/29305
   "Feature/engineremoval"
 * https://github.com/openssl/openssl/pull/29311
   "Documentation for BIO flags and related functions"
 * https://github.com/openssl/openssl/pull/29338
   "merge feature/removesslv3"
 * https://github.com/openssl/openssl/pull/29366
   "Remove support for custom EVP_MDs"
 * https://github.com/openssl/openssl/pull/29380
   "Remove crypto-mdebug-backtrace option from config"
 * https://github.com/openssl/openssl/pull/29381
   " Added LMS support for OpenSSL commandline signature verification using
   pkeyutl."
 * https://github.com/openssl/openssl/pull/29384
   "Remove support for custom EVP_PKEY_METHODs"
 * https://github.com/openssl/openssl/pull/29385
   "Atexit.final draft.cleanup"
 * https://github.com/openssl/openssl/pull/29387
   "Add ASN1_BIT_STRING_get_length()"
 * https://github.com/openssl/openssl/pull/29405
   "Remove support EVP_PKEY_ASN1_METHODs from the public API"
 * https://github.com/openssl/openssl/pull/29427
   "Remove the c_rehash script"
 * https://github.com/openssl/openssl/pull/29428
   "Constify return value of X509_get_X509_PUBKEY()"
 * https://github.com/openssl/openssl/pull/29435
   "Add SRTP KDF"
 * https://github.com/openssl/openssl/pull/29445
   "Remove BIO_f_reliable() as it is broken"
 * https://github.com/openssl/openssl/pull/29465
   "Constify X509_get_ext() and friends.."
 * https://github.com/openssl/openssl/pull/29468
   "constify  X509_NAME."
 * https://github.com/openssl/openssl/pull/29488
   "Constify the X509_STORE_CTX argument to the lookup_certs functions."
 * https://github.com/openssl/openssl/pull/29576
   "KDF: Add configuration options to disable many of the KDF algorithms."
 * https://github.com/openssl/openssl/pull/29612
   "Support multiple names for certificate verification"
 * https://github.com/openssl/openssl/pull/29635
   "SSL_CTX_is_server() was added"
 * https://github.com/openssl/openssl/pull/29639
   "Disabling explicit EC curves encoding"
 * https://github.com/openssl/openssl/pull/29640
   "add thunking for compare function to OPENSSL_STACK"
 * https://github.com/openssl/openssl/pull/29646
   "Added SSL_CTX_get0_alpn_protos() and SSL_get0_alpn_protos()"
 * https://github.com/openssl/openssl/pull/29653
   "Drop darwin-i386(-cc) targets from Configurations"
 * https://github.com/openssl/openssl/pull/29658
   "Disable support of weak elliptic curves in TLS by default"
 * https://github.com/openssl/openssl/pull/29672
   "Drop darwin-ppc{,64} targets"
 * https://github.com/openssl/openssl/pull/29721
   "Make OPENSSL_cleanup() G A"
 * https://github.com/openssl/openssl/pull/29813
   "Make X509_ATTRIBUTE accessor functions const-correct"
 * https://github.com/openssl/openssl/pull/29862
   "Make ASN1_STRING opaque"
 * https://github.com/openssl/openssl/pull/29874
   "Take OPENSSL_atexit() for a walk behind the barn."
 * https://github.com/openssl/openssl/pull/29926
   "Provide ASN1_BIT_STRING_set1()"
 * https://github.com/openssl/openssl/pull/29953
   "Support for RFC8998 `sm2sig_sm3`, `curveSM2` and its ML-KEM-768 hybrid."
 * https://github.com/openssl/openssl/pull/29971
   "X509: apply AKID verification checks when X509_V_FLAG_X509_STRICT is set"
 * https://github.com/openssl/openssl/pull/29982
   "Improved reporting of shared and peer sigalgs"
 * https://github.com/openssl/openssl/pull/29991
   "Fix of SSL_get_error() so that it no longer depends on the state
   of the error stack"
 * https://github.com/openssl/openssl/pull/29995
   "Add abilty to use static vcruntime"
 * https://github.com/openssl/openssl/pull/30005
   "Make ERR_STATE opaque and remove related deprecated functions"
 * https://github.com/openssl/openssl/pull/30011
   "Deprecate ASN1_OBJECT_new()."
 * https://github.com/openssl/openssl/pull/30020
   "Const correct time parameter for X509_cmp_time(), X509_time_adj()
   and X509_time_adj_ex()."
 * https://github.com/openssl/openssl/pull/30024
   "CRL: reject malformed CRL Number and CRL Delta Indicator"
 * https://github.com/openssl/openssl/pull/30028
   "Add TLS 1.3 SM ciphersuites"
 * https://github.com/openssl/openssl/pull/30031
   "Mostly deprecated is slightly not deprecated...."
 * https://github.com/openssl/openssl/pull/30033
   "Remove the &quot;msie-hack&quot; option from openssl ca"
 * https://github.com/openssl/openssl/pull/30034
   "Use the appropriate libctx when executing CMS_SignerInfo_verify"
 * https://github.com/openssl/openssl/pull/30035
   "Constify X509_verify"
 * https://github.com/openssl/openssl/pull/30036
   "Constify more X509 arguments and return values"
 * https://github.com/openssl/openssl/pull/30044
   "Added BIO_set_send_flags() function to set flags passed to send(),
   sendto(), and sendmsg()"
 * https://github.com/openssl/openssl/pull/30048
   "change from I-D to RFC 9849 and resolve TODO(ECH) cases"
 * https://github.com/openssl/openssl/pull/30053
   "Constify NAME_CONSTRAINTS_check and NAME_CONSTRAINTS_check_CN"
 * https://github.com/openssl/openssl/pull/30054
   "Consity X509_add_cert and X509_self_signed"
 * https://github.com/openssl/openssl/pull/30055
   "Constify various functions that were non const due to extension cache"
 * https://github.com/openssl/openssl/pull/30056
   "Constify X509_build_chain"
 * https://github.com/openssl/openssl/pull/30058
   "Constify X509_chain_check_suiteb"
 * https://github.com/openssl/openssl/pull/30067
   "Constify X509_check_issued and friends"
 * https://github.com/openssl/openssl/pull/30071
   "constify X509_check_trust, X509_TRUST_add"
 * https://github.com/openssl/openssl/pull/30072
   "Constify X509_to_X509_REQ and X509_REQ_to_X509"
 * https://github.com/openssl/openssl/pull/30073
   "Constify X509_print_fp and X509_print_ex_fp"
 * https://github.com/openssl/openssl/pull/30074
   "Constify X509_STORE_add_cert()"
 * https://github.com/openssl/openssl/pull/30076
   "Constify X509_STORE_CTX functions invoving X509 *"
 * https://github.com/openssl/openssl/pull/30079
   "Constify X509_CRL_get0_by_cert"
 * https://github.com/openssl/openssl/pull/30080
   "Constify X509v3_asid_validate_resource_set
   and X509v3_addr_validate_resource_set"
 * https://github.com/openssl/openssl/pull/30082
   "Constify X509_REQ_get1_email, X509_get1_email and X509_get1_ocsp."
 * https://github.com/openssl/openssl/pull/30084
   "Constify X509_issuer_and_serial_hash"
 * https://github.com/openssl/openssl/pull/30089
   "Added -expected-rpks s_client/server option"
 * https://github.com/openssl/openssl/pull/30090
   "Constify X509_CRL_get0_by_cert"
 * https://github.com/openssl/openssl/pull/30092
   "constify X509_find_by_issuer_and_serial"
 * https://github.com/openssl/openssl/pull/30096
   "Constify X509_find_by_subject"
 * https://github.com/openssl/openssl/pull/30098
   "Add a changes entry for the x509 time function changes"
 * https://github.com/openssl/openssl/pull/30113
   "Add keyshare floating"
 * https://github.com/openssl/openssl/pull/30117
   "Constify X509_OBJECT_[get0|set1]_X509 and friends"
 * https://github.com/openssl/openssl/pull/30127
   "Constify a bunch of seldom used X509 functions. "
 * https://github.com/openssl/openssl/pull/30128
   "Removes fixed version TLS methods."
 * https://github.com/openssl/openssl/pull/30140
   "Ensure TLS 1.3 ciphersuites are actually for TLS 1.3"
 * https://github.com/openssl/openssl/pull/30171
   "CRL: Reject CRLs with malformed Issuing Distribution Point"
 * https://github.com/openssl/openssl/pull/30200
   "Remove remnant SSL_FIPS flag"
 * https://github.com/openssl/openssl/pull/30229
   "X509 returned by X509_REQ_to_X509() should not be (const ...)"
 * https://github.com/openssl/openssl/pull/30235
   "Make X509_up_ref and X509_free take const X509 *"
 * https://github.com/openssl/openssl/pull/30249
   "x509: remove erroneous critical extension enforcement"
 * https://github.com/openssl/openssl/pull/30252
   "Some more X509 extension add/del polish"
 * https://github.com/openssl/openssl/pull/30263
   "Restrict the number of keyshares/groups/sigalgs a server is willing
   to accept"
 * https://github.com/openssl/openssl/pull/30265
   "Unconstify X509_find_by_issuer_and_serial() and X509_find_by_subject()"
 * https://github.com/openssl/openssl/pull/30272
   "Partially revert &quot;Constify X509_STORE_CTX functions invoving X509
   *&quot;"
 * https://github.com/openssl/openssl/pull/30273
   "Revert &quot;Make X509_up_ref and X509_free take const X509 *&quot;"
 * https://github.com/openssl/openssl/pull/30276
   "Un-constify X509_OBJECT_get0_X509 and X509_OBJECT_set1_X509"

The changes associated with these PRs are already mentioned in 3.6.x changes:
 * https://github.com/openssl/openssl/pull/28760
   "Improve the CPUINFO display for RISC-V"
 * https://github.com/openssl/openssl/pull/28797
   "Fix regression when X509_V_FLAG_CRL_CHECK_ALL is set"
 * https://github.com/openssl/openssl/pull/28955
   "Fix for TLS handshake issue with GnuTLS #28902"
 * https://github.com/openssl/openssl/pull/29155
   "fix(x509.c): fixed -checkend return values"
 * https://github.com/openssl/openssl/pull/29214
   "s390x: Check and fail on invalid malformed ECDSA signatures"
 * https://github.com/openssl/openssl/pull/29242
   "Clang format head"
 * https://github.com/openssl/openssl/pull/29251
   "Fix change of behavior of the single stapled OCSP response API"
 * https://github.com/openssl/openssl/pull/30204
   "Fix detection of plaintext HTTP over TLS"
 * https://github.com/openssl/openssl/pull/30384
   "Fix #19891 CONNECT request for IPv6 targets in OSSL_HTTP_proxy_connect"
 * https://github.com/openssl/openssl/pull/30557
   "re-constructorize the cpuid stuff, but fix riscv to not depend
   on BIO_snprintf."

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Original-PR: https://github.com/openssl/openssl/pull/30817)
Original-Commit: 8fba5d0d9c64 "CHANGES.md, NEWS.md: updates for 4.0.0 final release"

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Sun Apr 26 13:17:07 2026
(Merged from https://github.com/openssl/openssl/pull/30847)

Use EVP_MD_fetch() instead of EVP_get_digestbynid() in X509/TLS paths

EVP_get_digestbynid() only searches the legacy built-in digest table and
cannot resolve provider-only digests, which breaks X509 signature info
computation, GOST TLS handshakes, and OCSP cert ID matching when the
digest is loaded exclusively through a provider. Switch the three affected
sites to use EVP_MD_fetch() (with the appropriate libctx/propq).
x509_sig_info_init() gains libctx/propq parameters propagated
from the X509 struct by its caller.

Resolves: https://github.com/openssl/openssl/issues/30604

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 13:13:14 2026
(Merged from https://github.com/openssl/openssl/pull/30888)

doc/man3/SSL_set1_host.pod: fix Deprecated Functions heading formatting

CLA: trivial
Fixes: f584ae959cbc "Let's support multiple names for certificate verification"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Richard Levitte <levitte@openssl.org>
MergeDate: Sun Apr 26 12:59:31 2026
(Merged from https://github.com/openssl/openssl/pull/30834)

aix: disable sendmmsg/recvmmsg

AIX header files don't properly expose sendmmsg/recvmmsg function
declarations. Disable these functions to avoid implicit declaration
errors with clang 16+.

This issue was discovered when building Node.js with clang.

CLA: trivial
Fixes: 52cd2a49c53e "Enable send-/recvmmsg for AIX >= 7.2 and disable SUPPORT_LOCAL_ADDR."
References: https://github.com/nodejs/node/pull/62656
Resolves: https://github.com/openssl/openssl/issues/30806

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 12:02:58 2026
(Merged from https://github.com/openssl/openssl/pull/30832)

.github: add AArch64 extension cross-compile workflow

This patch adds an AArch64-specific extension cross-compile workflow.
This is inspired by the existing RISC-V extension cross-compile
workflow and applies the same matrix-driven approach to AArch64.

References: https://github.com/openssl/openssl/issues/29269
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
MergeDate: Sun Apr 26 11:53:08 2026
(Merged from https://github.com/openssl/openssl/pull/30764)

Make win32_pathbyaddr more reliable

A user has reported that win32_pathbyaddr can be unreliable in
multithreaded environments. See:

https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot

Specifically they have observed the following behavior, as noted in the
above article:

When taking snapshots that include heaps and modules for a process other than
the current process, the CreateToolhelp32Snapshot function can fail or return
incorrect information for a variety of reasons. For example, if the loader data
table in the target process is corrupted or not initialized, or if the module
list changes during the function call as a result of DLLs being loaded or
unloaded, the function might fail with ERROR_BAD_LENGTH or other error code.
Ensure that the target process was not started in a suspended state, and try
calling the function again. If the function fails with ERROR_BAD_LENGTH when
called with TH32CS_SNAPMODULE or TH32CS_SNAPMODULE32, call the function again
until it succeeds.

This behavior necessitates calling DSO_pathbyaddr mutiple times to get a
succesful return code.

win32_pathbyaddr can be made more reliable, avoiding the need for multiple calls
by using alternate windows apis that are not/less succeptible to these transient
errors in multithreaded environments.

refactor win32_pathbyaddr here to implement that increased reliability.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Sun Apr 26 11:48:58 2026
(Merged from https://github.com/openssl/openssl/pull/30705)

Deprecate ASN1_BIT_STRING_set()

Replacement: ASN1_BIT_STRING_set1

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
MergeDate: Sun Apr 26 11:45:27 2026
(Merged from https://github.com/openssl/openssl/pull/30692)

apps: Move PATH_MAX define out of the win32 block

The PATH_MAX define is needed on HURD which is now skipped since it is
winthin the _WIN32 block.

Move the PATH_MAX check+define outside of the _WIN32 block.

Fixes: a2e5848d9d11 "s_client and s_server options for ECH"
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Apr 26 11:35:52 2026
(Merged from https://github.com/openssl/openssl/pull/30520)

Fix double-free in mlx_kem_dup() default case

Null mkey/xkey immediately after OPENSSL_memdup() so that any failure
path (including propq strdup) can safely call mlx_kem_key_free() without
risking a double-free on the source key's material. Use key->* rather
than ret->* for source-state checks to make ownership explicit.

Test that mlx_kem_dup() with partial key selection (e.g.
EVP_PKEY_PUBLIC_KEY) does not corrupt the original key's mkey/xkey
sub-objects.  Covers X25519MLKEM768, SecP256r1MLKEM768,
and SecP384r1MLKEM1024.

Fixes: 4b1c73d2dd74 "ML-KEM hybrids for TLS"
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Sun Apr 26 11:14:12 2026
(Merged from https://github.com/openssl/openssl/pull/30511)

Removes SSLv2 support in TLSProxy.

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Apr 24 20:11:08 2026
(Merged from https://github.com/openssl/openssl/pull/30916)

Add intelligence to asn1_d2i_read_bio for reading entire header without blocking for extra data

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/30401)

Fix error check for EVP_CTRL_AEAD_GET_TAG

"< 0" is definitely wrong as it can return 0 on error.
Change the checks that are not of the form "== 1" or "!= 1" to "<= 0".

Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 24 11:29:50 2026
(Merged from https://github.com/openssl/openssl/pull/30923)

Removes duplicated __owur.

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 24 08:09:10 2026
(Merged from https://github.com/openssl/openssl/pull/30933)

Add memory allocation failure testing framework

Introduce ADD_MFAIL_TEST for exhaustive testing of allocation failure
handling in individual functions. The framework repeatedly calls the
test function, each time failing one allocation later within the
section bracketed by mfail_start() and mfail_end(), verifying that
every failure path returns 0 without crashing or leaking.

Custom allocators are installed once at startup via
CRYPTO_set_mem_functions(). When not armed, they pass through to
malloc/realloc/free. Installation can be disabled by setting
OPENSSL_TEST_MFAIL_DISABLE for tests that need the default allocator
(e.g. those using OPENSSL_MALLOC_FAILURES).

Additional environment variables control test execution:
OPENSSL_TEST_MFAIL_SKIP_ALL, OPENSSL_TEST_MFAIL_SKIP_SLOW,
OPENSSL_TEST_MFAIL_POINT, and OPENSSL_TEST_MFAIL_START.

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 23 20:23:34 2026
(Merged from https://github.com/openssl/openssl/pull/30871)

Document semantic changes for EVP_get_*by* functions

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/30646)

Drop redundant/confusing NULL check

- The pointer cannot be NULL, and test only confuses static analysers.

- Incidentally, undo clang auto-format of  displayed tables in the same file.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 23 14:03:40 2026
(Merged from https://github.com/openssl/openssl/pull/30829)

Drop value barrier from ML-DSA reduce_once

This mirrors the corresponding code in ML-KEM and works under
the same conditions/assumptions.  Also adjusted related
functions with unnecessary 2-layers of constant_time selects
where one suffices (now also matching BoringSSL).

Intentionally uses the constant time instrumentation PR as its
merge-base, so to be merged after than has baked in for a few
days and shows working CT tests in daily CI runs.

Sample before/after performance pairs and percent throughput
increases for one X86_64 CPU:

              keygens/s    sign/s  verify/s
    ML-DSA-44   18728.3    6061.2   23251.6
    ML-DSA-44   21077.2    7392.4   27244.3
    ML-DSA-44     12.5%     22.0%     17.2%

    ML-DSA-65   10084.3    3603.0   13988.6
    ML-DSA-65   11197.9    4549.7   16208.4
    ML-DSA-65     11.0%     26.3%     15.9%

    ML-DSA-87    7184.8    2917.3    8141.0
    ML-DSA-87    8132.4    3693.7    9430.7
    ML-DSA-87     13.2%     26.6%     15.8%

and here's the same for an Apple silicon M2:

              keygens/s    sign/s  verify/s
    ML-DSA-44   17235.7    3099.3   15744.5
    ML-DSA-44   21855.2    4907.6   22849.0
    ML-DSA-44     26.8%     58.3%     45.1%

    ML-DSA-65    9165.8    1908.5   10058.3
    ML-DSA-65   11262.7    3069.6   14348.1
    ML-DSA-65     22.9%     60.8%     42.6%

    ML-DSA-87    6596.1    1563.6    6330.8
    ML-DSA-87    8404.9    2584.6    8767.6
    ML-DSA-87     27.4%     65.3%     38.5%

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 23 13:55:05 2026
(Merged from https://github.com/openssl/openssl/pull/30864)

ci: Add MSYS2-MINGW64 build

MINGW64 with MSYS2 environment is a supported platfrom
but not covered in CI.

This patch adds trivial rebuild test (but avoid 3rd party
scripts), with the same restrictions as MINGW64.

Tests and strict warnings need to be fixed later.

Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Dmitry Misharov <dmitry@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Thu Apr 23 12:12:36 2026
(Merged from https://github.com/openssl/openssl/pull/30906)

docs: Fix and add documentation about AES-WRAP-PAD ciphers out parameter

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Apr 22 08:13:31 2026
(Merged from https://github.com/openssl/openssl/pull/30653)

doc: correct X509v3_get_ext_by_NID.pod to reflect CRL/REVOKED extension behavior

The man page previously stated that X509_CRL_delete_ext() and
X509_REVOKED_add_ext() are 'otherwise identical to the X509v3 functions,'
which is inaccurate. These routines use X509v3_delete_extension(), not
X509v3_delete_ext(), following the changes in #30350 and #30518.
Update the documentation to accurately describe this difference.

CLA: trivial

Signed-off-by: legin hpesoj <ncj2394@rit.edu>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Apr 22 08:10:46 2026
(Merged from https://github.com/openssl/openssl/pull/30677)

Add valgrind CT support to ML-DSA

Also slightly refactor the ML-KEM version to share the necesasry
defines, and add a daily CI run to check both (presently, for just some
platforms with known working valgrind support).

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 22 07:55:14 2026
(Merged from https://github.com/openssl/openssl/pull/30863)

Reject empty TLS 1.3 HRR cookie

RFC 8446 defines the Cookie extension as containing a non-empty cookie
vector. The client-side HRR parser accepted a zero-length cookie
because PACKET_memdup() treats an empty packet as success, which
deferred failure until later in the handshake.

Reject an empty cookie during HRR parsing with decode_error and add a
regression test.

Fixes #30868
Fixes: cfef5027bf27 "Add basic TLSv1.3 cookie support"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Wed Apr 22 07:50:25 2026
(Merged from https://github.com/openssl/openssl/pull/30892)

Use proper compiler features abstraction for older compilers

"inline" -> "ossl_inline"
"__func__" -> "OPENSSL_FUNC"
"snprintf" -> "BIO_snprintf"

CLA: trivial
Fixes: 8e9771cf2259 "Use stub declarations in engine.h"
Fixes: da8f09846b98 "Add ASN1_BIT_STRING_get_length()"
Fixes: 74d47c8e66e0 "Provide ASN1_BIT_STRING_set1()"
Fixes: 7debe0ddeff7 "ECH external APIs"
Fixes: 4af71a77387c "ECH CLI implementation"
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 22 07:22:57 2026
(Merged from https://github.com/openssl/openssl/pull/30901)

pkey(1) missing setup for interactive pass prompt

The changes in #29324 neglected some setup needed for interactive
password prompting, leading to a segfaul when pkey(1) is asked to
encrypt, but not given an explicit `-pass` argument.

The required plumbing is added.

Fixes: #30889
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 22 07:04:47 2026
(Merged from https://github.com/openssl/openssl/pull/30904)

Fix memory leak in load_key_certs_crls() when add/push fails

When X509_add_cert() or sk_X509_CRL_push() failed, the cert or CRL from
OSSL_STORE was not freed. Free on failure to avoid a leak.

Fix 90-test_memfail.t parsing of count output so the memfail suite runs
correctly: parse 'skip: N count M' with a regex (handles '# ' prefix),
return (0,0) if the count file cannot be opened, and skip with a clear
message when total malloc count is 0 instead of planning 0 tests.

Apply clang-format to test/load_key_certs_crls_memfail.c.

- apps/lib/apps.c: free cert/CRL on add/push failure
- test/build.info: add load_key_certs_crls_memfail (allocfail-tests)
- test/load_key_certs_crls_memfail.c: regression test for issue #30364
- test/recipes/90-test_memfail.t: fix get_count_info parsing and plan

Issue #30364

Fixes: 6d382c74b375 "Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c"
Fixes: d7fcee3b3b5fa "OSSL_HTTP_parse_url(): add optional port number return parameter and strengthen documentation"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 21 08:50:18 2026
(Merged from https://github.com/openssl/openssl/pull/30428)

apps/enc.c: typo fix in -k option description

Add missing closing parenthesis.

Fixes: de89ca9347c2 "apps/enc.c: Moved -pass, -k, -kfile to encryption options"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Apr 20 10:18:05 2026
(Merged from https://github.com/openssl/openssl/pull/30813)

fips: mark X448MLKEM1024 as non-approved

The [FIPS 140-3I.G.](https://csrc.nist.gov/csrc/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf)
Section D.S Key Encapsulation Mechanisms have been substantially
update on April 9, 2026.

It now explicitely lists that hybrid mechanisms must be fixed
combinations with both portions being in boundary, and the intent
should be to use them with an approved combiner such as HKDF as part
of a protocol. With the combinations from the
https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem
explicitely mentioned that they can reach appoved or allowed claims.

Note that consensus for TLS group for X448MLKEM1024 failed to reach on
the [pqc forum](https://mailarchive.ietf.org/arch/browse/tls/?gbt=1&index=YIHJrbWVPdXIr8q57nsEUUmuaIo) and is not part of the
https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem. And there
are no other protocols defined that use this hybrid with an approved
combiner.

Also on https://test.openquantumsafe.org/ there is x448_mlkem768 but
no X448MLKEM1024.

To avoid any confusion, it is best to mark this hybrid as non-approved
going forward. It is likely also worthfile to deprecate X448MLKEM1024
altogether.

Fixes: https://github.com/openssl/openssl/pull/26220
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Mon Apr 20 10:08:09 2026
(Merged from https://github.com/openssl/openssl/pull/30856)

ci: Add MINGW64 build

MINGW64 is supported platfrom but not covered in CI.

This patch adds trivial rebuild test, for now without strict
warnings (need to be fixed later).

Fixes: https://github.com/openssl/project/issues/1911
Signed-off-by: Milan Broz <gmazyland@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Apr 20 10:04:58 2026
(Merged from https://github.com/openssl/openssl/pull/30860)

sock_read: check ret==0 before BIO_sock_should_retry()

POSIX states errno is only valid when the return value indicates an
error.  recv() sets errno only on -1; when it returns 0 (peer closed)
errno is unspecified.

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Mon Apr 20 09:59:27 2026
(Merged from https://github.com/openssl/openssl/pull/30877)

.github/workflows: remove openssl-3.2 and openssl-3.3 from CI jobs

These branches are EOL, so there is no need to keep running CI jobs
for them.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Mon Apr 20 09:57:54 2026
(Merged from https://github.com/openssl/openssl/pull/30881)

Fix prototype typo in X509_NAME_get_index_by_NID

s/cont/const/

Fixes: b0f2107b4404 "Constify X509_NAME"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 20 07:54:23 2026
(Merged from https://github.com/openssl/openssl/pull/30865)

Make QUIC radix tests friendly to clang-format

this is yet another small fallout from clang-format
style change. This time for radix tests.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 17 10:50:07 2026
(Merged from https://github.com/openssl/openssl/pull/30844)

Fixes AES optimisations for Fujitsu M10 cause SEGV #29085

Fixes off-by-one error in AES optimisations for Fujitsu Sparc CPUs.

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Fri Apr 17 10:46:01 2026
(Merged from https://github.com/openssl/openssl/pull/30814)

ASN1_BIT_STRING_name_print check BIO_* RVs

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Fri Apr 17 10:44:19 2026
(Merged from https://github.com/openssl/openssl/pull/30691)

Grow the init_buf incrementally as we receive data

Instead of growing the init_buf buffer immediately to the full size of the
expected message, we grow it incrementally as we receive the data. This
prevents abuse where the remote peer claims a very large message size, but
then doesn't send it.

This change is as a result of a security issue reported to the
openssl-security team by Okta Red Team. The openssl-security
team have decided to handle this as a "bug or hardening" only fix.

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Fri Apr 17 10:08:34 2026
(Merged from https://github.com/openssl/openssl/pull/30792)

ossl_curve448_scalar_halve(): Fix -ansi build

Move statement after declarations.
Fixes 4247fb98def703bcc55952f17f426331cce08d09

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Fri Apr 17 06:15:24 2026
(Merged from https://github.com/openssl/openssl/pull/30872)

(cherry picked from commit e812720ddca26c88d8704d55de606881ccec8ea7)

port_default_packet_handler() should not attempt to parse QUIC packet
header when destination connection id is not present. To save CPU cycles.

Issue has been noticed and kindly reported by Dan Carpenter via
openssl-users@ mailing list.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 16 22:59:33 2026
(Merged from https://github.com/openssl/openssl/pull/30795)

ossl_err_get_state_int(): Avoid saving the last sys error if not needed

In calls like ERR_set_mark(), ERR_clear_last_mark() and
others, there is no point in saving the last sys error.

It can be potentially expensive (on Windows).

Reviewed-by: Simo Sorce <simo@redhat.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Thu Apr 16 18:12:49 2026
(Merged from https://github.com/openssl/openssl/pull/30179)

Fix off-by-one in "groups list" parser

When parsing the configured TLS supported groups list reallocating of the list
of "tuples" happened one element too late.  The current tuple count is the
number of "closed" (completed) tuples, the currently active tuple occupies
one more slot, so we need space for `tuple count + 1` elements.

This is only an issue while parsing configurations (not attacker controlled),
and only if the group list somehow manages to contain 32 or distinct elements
(each in its own tuple, and even though OpenSSL does not implement that many
groups in typical builds).

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:17:38 2026
(Merged from https://github.com/openssl/openssl/pull/30838)

Add a test for too many PSKs

We test that even if we add too many PSKs we still handle the
ClientHello correctly.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:07:38 2026
(Merged from https://github.com/openssl/openssl/pull/30761)

Limit the number of PSKs we accept

To prevent attacks where an unauthenticated client sends us a large
number of PSKs, we place a limit on the number we are prepared to
accept.

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:07:37 2026
(Merged from https://github.com/openssl/openssl/pull/30761)

riscv: weaken capscheck for rv64gc_v_zvkned_hwprobe entry

QEMU 8.2.2 (ubuntu-latest) does not report ZVKNED via hwprobe
despite zvkned=true being set in QEMU_CPU, so the _V_ZVKNED
assertion would fail in CI for a reason unrelated to OpenSSL.

Weaken the check to _V, which QEMU 8.2.2 does report correctly.
The ZVKNED assertion can be restored once the CI moves to a QEMU
version with full Zvk* hwprobe coverage.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:43 2026
(Merged from https://github.com/openssl/openssl/pull/30713)

riscv: add capscheck assertion to hwprobe CI entries

The two hwprobe-based matrix entries exercise hwprobe_to_cap() but
previously contained no assertion to verify that expected extensions
were actually detected; tests pass regardless of which code path is
taken because both the optimised and fallback paths produce correct
output.

Add an optional capscheck field to the matrix schema.  When set, a
new "check detected capabilities" step runs
"openssl info -cpusettings" and asserts the output matches the
given extended regular expression.

Set capscheck for the two hwprobe entries:
- rv64gc_novector_hwprobe: assert "_ZBB" is present.
  With the IS_IN_DEPEND_VECTOR bug, scalar extensions are gated on
  VECTOR_CAPABLE (false when V is absent), so ZBB is not detected
  and the assertion fails.
- rv64gc_v_zvkned_hwprobe: assert "_V_ZVKNED" is present.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/30713)

riscv: add hwprobe-based CI entries for capability detection

All existing RISC-V cross-compile matrix entries set OPENSSL_riscvcap,
which causes OPENSSL_cpuid_setup() to call parse_env() and skip the
hwprobe_to_cap() code path entirely.  That path has never been exercised
by CI, leaving bugs in it undetectable.

Add two matrix entries that omit opensslcapsname so OPENSSL_riscvcap is
not set and hwprobe_to_cap() is called:

- rv64gc_novector_hwprobe: rv64 with ZBB/ZBC/ZBS/ZBKB, V disabled.
  AT_HWCAP V bit is clear (VECTOR_CAPABLE=false).  Exercises the
  scalar-extension detection branch of hwprobe_to_cap().

- rv64gc_v_zvkned_hwprobe: rv64 with V (vlen=128) and ZVKNED.
  AT_HWCAP V bit is set (VECTOR_CAPABLE=true).  Exercises the
  vector-extension detection branch and the IS_IN_DEPEND_VECTOR
  guard that gates Zvk* extensions on V availability.

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:41 2026
(Merged from https://github.com/openssl/openssl/pull/30713)

riscv: fix IS_IN_DEPEND_VECTOR range check

The macro checked (ZVX_MIN >= offset) which is equivalent to
(offset <= ZVX_MIN), making it true for offsets 0-15 instead of
the intended range [ZVX_MIN, ZVX_MAX] = [15, 23].

The practical effect in hwprobe_to_cap() was inverted:
- Scalar extensions (ZBA..ZKT, offsets 0-14) were incorrectly
  treated as vector-dependent and suppressed when VECTOR_CAPABLE
  was false, preventing their detection via hwprobe.
- Vector extensions ZVBC..ZVKSH (offsets 16-23) were not treated
  as vector-dependent, allowing them to be enabled via hwprobe
  even when the V extension was absent.

Fix by changing >= to <= so the macro correctly tests whether
offset falls in [ZVX_MIN, ZVX_MAX].

Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:03:40 2026
(Merged from https://github.com/openssl/openssl/pull/30713)

EAP-FAST: echo Session ID on PAC-based session resumption

Ensure that when a ClientHello includes both a Session ID and a PAC-Opaque
in the SessionTicket extension, the server echoes the same Session ID in
the ServerHello if the session is resumed based on the PAC-Opaque.

Fixes #29095

Signed-off-by: Daniel Kubec <kubec@openssl.foundation>
Co-authored-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 17:01:03 2026
(Merged from https://github.com/openssl/openssl/pull/30695)

25-test_verify.t: improve variable and test name, add relative {file:,}D:cert test for Windows

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 16 16:52:57 2026
(Merged from https://github.com/openssl/openssl/pull/27554)

Factor out ossl_file_stat() from file_store.c:file_open()

It is also simplified and generalized.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Thu Apr 16 16:52:56 2026
(Merged from https://github.com/openssl/openssl/pull/27554)

Clarify the set_session_id_context functions

Clarify when they can be used, and introduce some warnings about using
them too late in the handshake. In particular using them in the server
name callback is too late.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:46:26 2026
(Merged from https://github.com/openssl/openssl/pull/30797)

Fix constant-time violation in ossl_curve448_scalar_halve

Add a value barrier to the mask variable in ossl_curve448_scalar_halve()
to prevent LLVM SimpleLoopUnswitchPass from introducing a
secret-dependent branch.

When compiled with Clang >= 17 at -O3, the mask which is static during
the loop (derived from the secret scalar LSB) is used by SimpleLoopUnswitchPass
to clone the loop body into two versions guarded by a branch on the secret bit.
This produces a side-channel that leaks nonce parity.

The value barrier forces the compiler to treat the mask as opaque,
preventing loop unswitching while maintaining identical performance.

A portable value_barrier_c448 macro is added to word.h to select the
appropriate barrier width (32 or 64 bit) based on C448_WORD_BITS.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:43:22 2026
(Merged from https://github.com/openssl/openssl/pull/30845)

Forward port release update commit to master branch

Bring NEWS.md/CHANGES.md into line with updates on the 4.0 branch

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Thu Apr 16 16:27:47 2026
(Merged from https://github.com/openssl/openssl/pull/30830)

TLSv1.3: reissue session ticket after full handshake on ciphersuite mismatch

When session resumption falls back to a full handshake due to a ciphersuite
mismatch, ensure a new session ticket is issued with the newly negotiated
ciphersuite.

Fixes #18549

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Apr 16 11:27:51 2026
(Merged from https://github.com/openssl/openssl/pull/30626)

ssl: Fix ssl_do_config to clean up errors on success with ERR_set_mark

ssl_do_config() could leave stale errors on the error stack even on
success, so that later error checking operations could mistakenly
surface these errors. Use ERR_set_mark()/ERR_pop_to_mark() to cleanly
discard errors when the function succeeds or when system config errors
are non-fatal.

Fixes #30760

Co-authored-by: Brandon Allard <brandon@redpanda.com>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Thu Apr 16 11:24:56 2026
(Merged from https://github.com/openssl/openssl/pull/30765)

ossl-guide-migration.pod: tfixes in TLS fixed ver meth deprecation desc

Change duplicating names of the suggested function names from TLS_* to DTLS_*
ones and fix the case of "API".

Co-Authored-by: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
MergeDate: Thu Apr 16 11:19:19 2026
(Merged from https://github.com/openssl/openssl/pull/30819)

Add regression tests to `test/evp_extra_test.c` that dynamically
discover all provided ciphers with non-zero IV length and verify
correct multi-step initialization semantics.

The EVP API permits key and IV to be supplied in separate
`EVP_CipherInit_ex()` calls (e.g. key-only followed by IV-only).
A recent bug (PR #29934, ASCON-AEAD128) demonstrated that a
provider may silently ignore a key-only init, resulting in reuse
of a previously loaded key during a subsequent IV-only init.

To prevent similar regressions, this change introduces three
generic tests that automatically cover all IV-taking ciphers:

Verifies that:
- `init(key) → init(iv)`
- `init(iv) → init(key)`

produce identical ciphertext (and authentication tag for AEAD
ciphers) compared to single-call `init(key, iv)`.

Primes a context with `key1/iv1`, then re-initializes via
`init(key2) → init(iv2)` and verifies the output matches a fresh
`encrypt(key2, iv2)` operation, ensuring that no previously stored
key is reused.

Encrypts using single-call initialization and then decrypts using
multi-step initialization, verifying plaintext recovery. For AEAD
ciphers, this also exercises tag verification through the
multi-step path.

Ciphers are discovered using `EVP_CIPHER_do_all_provided()`,
requiring no maintenance when new IV-taking ciphers are added.
SIV mode is skipped due to its synthetic IV semantics. CCM mode
handling includes required length declarations.

This provides broad regression coverage for the provider
implementations that support multi-step EVP initialization.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 16 07:08:17 2026
(Merged from https://github.com/openssl/openssl/pull/30141)

Fix broken sslapitest with old FIPS providers

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Thu Apr 16 06:34:31 2026
(Merged from https://github.com/openssl/openssl/pull/30858)

test/quicapitest.c: restore array formatting butchered by clang-format

Shut off clang-format, as it is incapable of formatting arrays properly,
and just mangles everything instead.  Also, while at it, drop the trailing
commas from TPARAM_CHECK_* definitions, as they are pretty confusing.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:37 2026
(Merged from https://github.com/openssl/openssl/pull/30580)

run-checker-ci.yml, run-checker-merge: add -DOPENSSL_USE_IPV6=0

Add -DOPENSSL_USE_IPV6=0 to run-checker-ci.yml and move no-ui
to run-checker-merge.

References: https://github.com/openssl/openssl/issues/30574
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:34 2026
(Merged from https://github.com/openssl/openssl/pull/30580)

Avoid creating TLSProxy on IPv6 loopback address is IPv6 is disabled

Add a parameter to TLSProxy::Proxy->new()
and TLSProxy::Proxy->new_dtls() that indicates IPv6 usage preference
and pass have_IPv6() to it, so IPv6 usage is avoided when it is disabled.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:33 2026
(Merged from https://github.com/openssl/openssl/pull/30580)

test/quicapitest.c: skip test_quic_peer_addr_v6() if IPv6 is disabled

Define and add the test only if OPENSSL_USE_IPV6 is set to 1.

Resolves: https://github.com/openssl/openssl/issues/30574
Fixes: beec4e146a9e "Add SSL_get_peer_addr() function to query peer address for QUIC"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:45:31 2026
(Merged from https://github.com/openssl/openssl/pull/30580)

include/openssl/x509_acert.h.in: add extern "C" linkage specification for C++

Fixes: dcee34c8f921 "Add RFC 5755 attribute certificate support"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Apr 15 12:36:41 2026
(Merged from https://github.com/openssl/openssl/pull/30796)

doc: clarify -hex option behavior in openssl prime

The -hex option description was ambiguous about its exact behavior.
Clarify that:
- With -generate: outputs the prime in hex instead of decimal
- When checking: interprets input as hex instead of decimal
- Output when checking is always hex regardless of this option

Fixes #19208

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 15 12:33:18 2026
(Merged from https://github.com/openssl/openssl/pull/29913)

.github/workflows/coveralls.yml: move the master branch to the top of the matrix

So its config options can be copied into a newly created branch more naturally.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:38 2026
(Merged from https://github.com/openssl/openssl/pull/30785)

.github/workflows/coveralls.yml: enable allocafil tests on openssl-4.0

This really should have been done when the branch was added, but better
late than never.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:37 2026
(Merged from https://github.com/openssl/openssl/pull/30785)

.github/workflows/coveralls.yml: add enable-lms to openssl-3.6 and openssl-4.0 configs

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:35 2026
(Merged from https://github.com/openssl/openssl/pull/30785)

.github/workflows/coveralls.yml: drop no-afalgeng from openssl-4.0 config

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:34 2026
(Merged from https://github.com/openssl/openssl/pull/30785)

.github/workflows/coveralls.yml: drop EOL branches from the run matrix

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:30:33 2026
(Merged from https://github.com/openssl/openssl/pull/30785)

Document ASN1_BIT_STRING functions

Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Wed Apr 15 12:25:45 2026
(Merged from https://github.com/openssl/openssl/pull/30690)

Update S/MIME tool documentation

CLA: trivial

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
MergeDate: Wed Apr 15 12:19:04 2026
(Merged from https://github.com/openssl/openssl/pull/30583)

doc: clarify -CAfile and -verifyCAfile semantics in s_server

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Wed Apr 15 12:11:34 2026
(Merged from https://github.com/openssl/openssl/pull/30405)

doc: Clarify that BN_CTX must not be NULL for BN arithmetic functions

The documentation for BN_add and related functions did not explicitly
state that the ctx parameter cannot be NULL. Users may assume NULL is
acceptable since some other OpenSSL functions allow it, but passing
NULL to functions like BN_mod_add() or BN_mod() causes a crash.

Update the documentation to explicitly state that ctx must not be NULL.

Fixes #12092

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Wed Apr 15 11:47:59 2026
(Merged from https://github.com/openssl/openssl/pull/29773)

Fix memory leak in ossl_uint_set_insert()

There is a missing call to OPENSSL_free() in the branch
where existing sets are merged to new range. There is
no evidence/POC OpenSSL poject is aware of the leak can
be triggered by QUIC protocol operation.

The issue has been kindly reported by Abhinav Agarwal (@abhinavagarwal07)

Fixes: c5ca718003e6 "uint_set: convert uint_set to use the list data type"
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 15 11:28:41 2026
(Merged from https://github.com/openssl/openssl/pull/30718)

riscv: fix missing VLEN >= 128 guard in AES-GCM dispatch

ossl_prov_aes_hw_gcm() returned &rv64i_zvkned_gcm when
RISCV_HAS_ZVKNED() was true but RISCV_HAS_ZVKB()/RISCV_HAS_ZVKG()
were false, without checking riscv_vlen() >= 128. All Zvkned
instructions require VLEN >= 128; on VLEN=64 hardware this would
cause illegal-instruction traps.

All other Zvk* dispatch sites already guard on riscv_vlen() >= 128.
Hoist the check to the outer if (RISCV_HAS_ZVKNED()) condition to
cover both return paths uniformly.

Fixes: d056e90ee58a "riscv: Provide vector crypto implementation of AES-GCM mode."
Signed-off-by: Christoph Müllner <christoph.muellner@vrull.eu>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Wed Apr 15 11:24:50 2026
(Merged from https://github.com/openssl/openssl/pull/30714)

ecp_s390x_nistp.c: reorder nullptr checks

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 15 11:01:22 2026
(Merged from https://github.com/openssl/openssl/pull/30648)

ecp_s390x_nistp.c: Reject negative digest length to prevent size_t underflow

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 15 11:01:20 2026
(Merged from https://github.com/openssl/openssl/pull/30648)

ossl-guide-migration: Fix ASN1_STRING_ functions formatting

keep bold and move to an unordered list

Co-authored-by: Tomáš Mráz <tm@t8m.info>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 15 10:54:01 2026
(Merged from https://github.com/openssl/openssl/pull/30629)

ossl-guide-migration: delete duplicate entry

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 15 10:54:00 2026
(Merged from https://github.com/openssl/openssl/pull/30629)

ossl-guide-migration: Format function names correctly

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
MergeDate: Wed Apr 15 10:53:59 2026
(Merged from https://github.com/openssl/openssl/pull/30629)

quic: fix channel leak when ossl_quic_provide_initial_secret fails

  In port_bind_channel(), when ossl_quic_provide_initial_secret()
  fails, the function returns without freeing the QUIC_CHANNEL
  that was just created by port_make_channel(). The caller sees
  new_ch == NULL and cannot free it, leaking the channel and all
  its sub-allocations (QRX, QTX, TXP, ACKM).

  Add ossl_quic_channel_free(ch) before the early return, matching
  the cleanup pattern already used by the other error paths in the
  same function (lines 864, 873).

  CWE-401

Reported-by: Sunwoo Lee <sunwoolee@kentech.ac.kr>
  CLA: trivial

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Apr 15 10:44:51 2026
(Merged from https://github.com/openssl/openssl/pull/30612)

Work around "Use of uninitialized value..." in mkinstallvars.pl

Avoid "Use of uninitialized value in concatenation (.) or string
at util/mkinstallvars.pl line 139." message by supplying COMMENT
in the mkinstallvars.pl call exporters/build.info.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:54:11 2026
(Merged from https://github.com/openssl/openssl/pull/30768)

NOTES-NONSTOP.md: remove the "Linking and Loading Considerations" section

Since the atexit() handler setup was removed in [1], the section content
is no longer relevant;  remove it.

[1] https://github.com/openssl/openssl/pull/29385

References: https://github.com/openssl/openssl/issues/30742
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Apr 14 08:50:36 2026
(Merged from https://github.com/openssl/openssl/pull/30776)

INSTALL.md: mention that no-atexit has no effect

Since the atexit() handler was removed in [1], no-atexit configuration
option has no effect, so update the documentation accordingly.

[1] https://github.com/openssl/openssl/pull/29385

References: https://github.com/openssl/openssl/pull/30742
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
MergeDate: Tue Apr 14 08:50:35 2026
(Merged from https://github.com/openssl/openssl/pull/30776)

Add docs for new atomic apis

Documents CRYPTO_atomic_load_ptr(), CRYPTO_atomic_store_ptr() and
CRYPTO_atomic_cmp_exch_ptr()

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:29:33 2026
(Merged from https://github.com/openssl/openssl/pull/30670)

Run make update

Adds CRYPTO_atomic_load_ptr, CRYPTO_atomic_store_ptr and
CRYPTO_atomic_cmp_exch_ptr

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:29:32 2026
(Merged from https://github.com/openssl/openssl/pull/30670)

convert rand_meth_lock to atomics

Using our previously created atomic ops, we can (almost) eliminate the
use of the rand_meth_lock.  This lock guards reads/write on the
RAND_default_meth global variable, which is generally written only once
during a process lifetime.  By replacing the lock with an atomic read
for reads, and an atomic compare and exchange or atomic store for
writes, we can significantly improve the execution time of
RAND_get_rand_method, which is called every time a process calls
RAND_bytes_ex()

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
MergeDate: Tue Apr 14 08:29:31 2026
(Merged from https://github.com/openssl/openssl/pull/30670)