TLSv1.3 capable SSL and crypto library
openssl:openssl from the portpkg audit reports nothing for this version.| CVE-2026-63073 | 9.8 | 2026-08-25 | Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summa… |
| CVE-2026-75803 | 9.1 | 2026-08-25 | Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation … |
| CVE-2026-84782 | 8.2 | 2026-09-29 | Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be rea… |
| CVE-2026-84784 | 7.5 | 2026-09-29 | Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC … |
| CVE-2026-72897 | 7.5 | 2026-09-29 | Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of a… |
| CVE-2026-54873 | 7.5 | 2026-09-29 | Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by … |
| CVE-2026-63072 | 7.5 | 2026-08-25 | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cl… |
| CVE-2026-63075 | 7.5 | 2026-08-25 | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can… |
| CVE-2026-63076 | 7.5 | 2026-08-25 | Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it… |
| CVE-2026-54874 | 7.5 | 2026-08-25 | Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Imp… |
| CVE-2026-14457 | 7.5 | 2026-08-25 | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured loca… |
| CVE-2026-18798 | 7.5 | 2026-08-25 | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap c… |
| CVE-2026-63074 | 5.9 | 2026-08-25 | Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance… |
| CVE-2026-75805 | 5.3 | 2026-09-29 | Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a … |
| CVE-2026-75806 | 5.3 | 2026-09-29 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter … |
| CVE-2026-75804 | 5.3 | 2026-09-29 | Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow… |
| CVE-2026-35189 | 5.3 | 2026-09-29 | Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact … |
| CVE-2026-42772 | 5.3 | 2026-09-29 | Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexit… |
| CVE-2026-77696 | 3.7 | 2026-09-29 | Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure S… |
| CVE-2026-54872 | 3.7 | 2026-09-29 | Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks… |
| CVE-2026-54875 | 3.7 | 2026-09-29 | Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact … |
| CVE-2026-35191 | 3.7 | 2026-09-29 | Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated cred… |
CVE-2026-35189, CVE-2026-35191, CVE-2026-42772, CVE-2026-54872, CVE-2026-54873, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782, CVE-2026-84783, CVE-2026-84784
CVE-2026-14457, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
CVE-2026-2637, CVE-2026-28386, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790
CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, CVE-2026-22796
security/openssl36: Security update to 3.6.5 Security: 0d183075-bcb5-11f1-b09d-8447094a420f MFH: 2026Q3b0e3d987f3
security/openssl36: Security update to 3.6.4 Security: 9008d14d-a0af-11f1-8144-8447094a420f MFH: 2026Q3a6341e066a
security/openssl36: Security update to 3.6.3 Security: 259b562f-64ab-11f1-8607-8447094a420f MFH: 2026Q26543b68ce7
all: drop support for FreeBSD 13, mips and risc64sf Reviewed by: many (*) Differential Revision: https://reviews.freebsd.org/D55624 Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh) many (*) acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka nobutaka pkubaj se tagattie thj Anton Saietskii GenericRikka Gert Doering Jan Bramkamp Oleh Hushchenkov Oleksandr Kryvulia Ralf van der Enden Yamagi desktop kde python tcltk office2a7c056120
security/openssl36: Security update to 3.6.2 Security: c7a52cee-32ab-11f1-9839-8447094a420f MFH: 2026Q250405c2e40
security/openssl36: Security update for CVE-2026-2673 Security: ee1e6a24-1eeb-11f1-81da-8447094a420fc57040e426
security/openssl: Chase addition of OpenSSL 4.0 in CONFLICTS5009a60ae7
security/openssl36: Security update to 3.6.1 Security: 4b824428-fb93-11f0-b194-8447094a420f MFH: 2026Q185c21fc347
security/openssl36: Security update to 3.6.0 release * No longer in BETA Security: 00e912c5-9e92-11f0-bc5f-8447094a420f7d0002a75e
security/openssl36: Update to 3.6.0.b1f1849b10df
security/openssl36: Add new OpenSSL 3.6 ALPHA * Not for production use7f24a4ad2b