OpenSSL 4.0.3 is out with 14 CVE fixes. If you run TLS on anything, check your package manager now and come back for the interesting parts afterward.
The one that actually matters is the timing side-channel in SM2 scalar multiplication on ARM64 and RISC-V. SM2 is the Chinese national standard for elliptic-curve cryptography (GB/T 32918.3), and non-constant-time scalar multiplication in a signature routine is not an academic problem. Someone can observe timing variations across many signatures and recover the private key. That has real-world consequences in certain deployment contexts that I do not need to spell out. The 4.0.3 fix covers the ARM64 and RISC-V paths specifically; a broader fix for non-constant-time scalar multiplication across all non-NIST curves ships alongside it. That wider patch covers Curve25519, brainpool curves, and SM2, meaning anything that is not P-256, P-384, or P-521 was leaking timing information. Most deployments do not use these curves. The ones that do should be patching with some urgency.
The QUIC block is five bugs. Five. In a single release. QUIC is “UDP but we reimplemented everything TCP does in a C library,” and the OpenSSL implementation has managed to ship: excessive amplification credit accounting, a CPU DoS from inefficient fragment reassembly, STREAM fragment metadata DoS, missing connection-level flow-control enforcement, and an unbounded RETIRE_CONNECTION_ID backlog. Some of these are denial-of-service. The flow-control one is almost funny since flow control is explicitly one of the selling points of QUIC over congested paths. To be fair, finding five bugs in a relatively new protocol implementation is normal; shipping fixes for five bugs at once is how you do it right. I’ll give them that.
CVE-2026-84783 is a use-after-free in the X.509 extension cache under concurrent use. The cache gets freed; another thread is still using it; the allocator decides your fate. If you call OpenSSL from multiple threads parsing certificates — and any server does — this can crash or worse depending on what ends up in the freed memory. Classic C. The extension parsing code in OpenSSL has been the source of half the memorable CVEs in this library’s history and it keeps producing.
CVE-2026-84782 hits DTLS 1.2 handshake retransmission. DTLS runs on UDP and has to implement its own retransmit state machine, and that state machine had a bug that could produce a denial-of-service condition. This only matters if you are running DTLS directly: VPN clients, WebRTC relays, some enterprise authentication protocols. If you do not know what DTLS is, you probably are not using it and this one does not apply to you.
Affected versions: everything before 3.0.23, 3.4.8, 3.5.9, 3.6.5, and 4.0.3.
openssl version -aIf you are still on 3.0.x: the project reached end-of-life in August. You have had months. The 3.0.23 backport is a courtesy; it is not a promise they keep doing this forever. The first proprietary-customer-only patch that shipped before the public 3.0 EOL announcement was a preview of exactly this dynamic. OpenSSL 3.5 is the current LTS. Move to it.
One thing OpenSSL 4.0 got right that rarely gets credit: the ENGINE API is finally gone. That interface was a 1998 abstraction for loading hardware crypto modules, and it had the kind of security surface area you get when you design something to be completely general without understanding how it will be abused. The 4.0 line dropped it cleanly. If you have vendored code that still registers OpenSSL engines, 4.0.x will not compile for you and that is the correct outcome. The GnuPG crypto refresh last month was the same kind of debt payment — old algorithms removed, modern cryptography formalized. The OpenSSL project’s actual upgrade discipline has been better than it gets credit for. Fourteen CVEs in a patch release is not evidence of a poorly run project; it is evidence of a project that audits its own QUIC implementation.