OpenSSL Release Announcement for 3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn

{
  "id": "1d931442ae7a08fd134d34793d78a3b9727f982bb25f7998696d28718a95f333",
  "url": "https://openssl-library.org/post/2026-01-27-release-announcement/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "OpenSSL Release Announcement for 3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19, 1.1.1ze and 1.0.2zn",
    "summary": "OpenSSL released security-fix versions across its 3.x and supported legacy branches. The announcement lists CVEs fixed for each version; 1.1.1ze and 1.0.2zn are for premium support customers only.",
    "evidence": "The OpenSSL Project team announces the release of new versions of our open-source toolkit for SSL/TLS.",
    "products": [
      {
        "name": {
          "value": "OpenSSL Library",
          "evidence": "OpenSSL Library 3.6.1"
        },
        "prerequisites": [
          {
            "value": "premium support customers only",
            "evidence": "CVEs fixed in 1.1.1ze: (premium support customers only)"
          },
          {
            "value": "premium support customers only",
            "evidence": "CVEs fixed in 1.0.2zn: (premium support customers only)"
          }
        ],
        "fixed_versions": [
          {
            "value": "3.6.1",
            "evidence": "Changes and CVEs fixed in 3.6.1:"
          },
          {
            "value": "3.5.5",
            "evidence": "Changes and CVEs fixed in 3.5.5:"
          },
          {
            "value": "3.4.4",
            "evidence": "CVEs fixed in 3.4.4:"
          },
          {
            "value": "3.3.6",
            "evidence": "CVEs fixed in 3.3.6:"
          },
          {
            "value": "3.0.19",
            "evidence": "CVEs fixed in 3.0.19:"
          },
          {
            "value": "1.1.1ze",
            "evidence": "CVEs fixed in 1.1.1ze: (premium support customers only)"
          },
          {
            "value": "1.0.2zn",
            "evidence": "CVEs fixed in 1.0.2zn: (premium support customers only)"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-11187",
        "evidence": "CVE-2025-11187 - Improper validation of PBMAC1 parameters in PKCS#12 MAC verification."
      },
      {
        "value": "CVE-2025-15467",
        "evidence": "CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing."
      },
      {
        "value": "CVE-2025-15468",
        "evidence": "CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID."
      },
      {
        "value": "CVE-2025-15469",
        "evidence": "CVE-2025-15469 - ‘openssl dgst’ one-shot codepath silently truncates inputs >16MB."
      },
      {
        "value": "CVE-2025-66199",
        "evidence": "CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation."
      },
      {
        "value": "CVE-2025-68160",
        "evidence": "CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes."
      },
      {
        "value": "CVE-2025-69418",
        "evidence": "CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls"
      },
      {
        "value": "CVE-2025-69419",
        "evidence": "CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion."
      },
      {
        "value": "CVE-2025-69420",
        "evidence": "CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function."
      },
      {
        "value": "CVE-2025-69421",
        "evidence": "CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function"
      },
      {
        "value": "CVE-2026-22795",
        "evidence": "CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing"
      },
      {
        "value": "CVE-2026-22796",
        "evidence": "CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-openssl-news",
  "document_id": 24089,
  "published_at": "2026-01-27T00:00:00+00:00"
}