OpenSSL 3.6.2 Security Update Addresses Eight Vulnerabilities and Fixes Regressions

Wed, 08 Apr 2026 20:24:00 +0200

OpenSSL has released version 3.6.2, addressing eight security vulnerabilities across multiple components. The most severe issue is rated as Moderate. Key fixes include incorrect failure handling in RSA KEM RSASVE encapsulation, a loss of key agreement group structure in server-side configuration, an out-of-bounds read in AES-CFB-128 on x86-64 CPUs with AVX-512 support, and potential use-after-free and NULL pointer dereference issues in DANE client code and CRL processing. Additional fixes address NULL dereference bugs in CMS recipient info handling and a heap buffer overflow in hexadecimal conversion. Beyond security patches, this release also resolves two behavioral regressions introduced in OpenSSL 3.6.0: restoration of the pre-3.6.0 X509_V_FLAG_CRL_CHECK_ALL behavior and correction of a stapled OCSP response handling issue causing handshake failures with certain clients. Systems running OpenSSL 3.6.x on x86-64 with AVX-512 should prioritize the AES-CFB-128 fix due to potential memor