v3.6.11
- Add
getServerstoResolverandClientChannelManagerto expose the origin pool by @gavinbunney in https://github.com/Netflix/zuul/pull/2143
Full Changelog: https://github.com/Netflix/zuul/compare/v3.6.10...v3.6.11
superset-helm-chart-0.16.0
Apache Superset is a modern, enterprise-ready business intelligence web application
1.0.0-beta.8
- feat(table-catalog): add object-backed catalog store by @marshawcoco in https://github.com/rustfs/rustfs/pull/3206
- feat(scanner): add partial scan resume hints by @marshawcoco in https://github.com/rustfs/rustfs/pull/3207
- chore: add missing-shard first-scene diagnostics by @houseme in https://github.com/rustfs/rustfs/pull/3213
- perf(erasure): remove UUID from clone + increase encode inflight budget by @overtrue in https://github.com/rustfs/rustfs/pull/3212
- chore: add delete-objects lock batch diagnostics by @houseme in https://github.com/rustfs/rustfs/pull/3218
- refactor(ecstore): migrate mutable globals into ECStore struct fields by @overtrue in https://github.com/rustfs/rustfs/pull/3214
- fix(signer): address post-merge review comments by @overtrue in https://github.com/rustfs/rustfs/pull/3216
- refactor(ecstore): migrate config globals into ECStore struct fields by @overtrue in https://github.com/rustfs/rustfs/pull/3219
- fix(server): normalize empty request content length by @GatewayJ in https://github.com/rustfs/rustfs/pull/3215
- feat(table-catalog): add REST catalog route surface by @marshawcoco in https://github.com/rustfs/rustfs/pull/3211
- feat(scanner): add versioned scan checkpoints by @marshawcoco in https://github.com/rustfs/rustfs/pull/3220
- fix(ecstore): skip hidden metadata in walk limit by @overtrue in https://github.com/rustfs/rustfs/pull/3224
- refactor(ecstore): add accessor methods for service globals by @overtrue in https://github.com/rustfs/rustfs/pull/3226
- fix(bucket-encryption): populate default KMS key for SSE-KMS without key ID by @overtrue in https://github.com/rustfs/rustfs/pull/3225
- fix(allocator): restore validated jemalloc target gating by @houseme in https://github.com/rustfs/rustfs/pull/3236
- feat(table-catalog): wire REST catalog MVP handlers by @marshawcoco in https://github.com/rustfs/rustfs/pull/3227
- feat(scanner): expose checkpoint and source work status by @marshawcoco in https://github.com/rustfs/rustfs/pull/3230
- feat(scanner): track scan cycle source work by @marshawcoco in https://github.com/rustfs/rustfs/pull/3240
- refactor(ecstore): add server configuration accessors by @overtrue in https://github.com/rustfs/rustfs/pull/3238
- feat(table-catalog): wire REST commit handler by @marshawcoco in https://github.com/rustfs/rustfs/pull/3239
- fix(admin): format policy JSON and improve error messages in service … by @GatewayJ in https://github.com/rustfs/rustfs/pull/3242
- fix: clean old data dirs on object overwrite by @GatewayJ in https://github.com/rustfs/rustfs/pull/3244
- chore(deps): update flake.lock by @houseme in https://github.com/rustfs/rustfs/pull/3250
- docs(docker): clarify bind mount permission setup by @cxymds in https://github.com/rustfs/rustfs/pull/3248
- fix(docker): align TLS compose healthchecks by @cxymds in https://github.com/rustfs/rustfs/pull/3246
- fix(replication): normalize local site endpoint port by @cxymds in https://github.com/rustfs/rustfs/pull/3249
- fix(ecstore): invalidate wiped disk id cache by @cxymds in https://github.com/rustfs/rustfs/pull/3251
- docs: add architecture migration guardrails by @overtrue in https://github.com/rustfs/rustfs/pull/3253
- feat(scanner): expose scan partial source status by @marshawcoco in https://github.com/rustfs/rustfs/pull/3247
- test: bypass proxy for embedded readiness probe by @overtrue in https://github.com/rustfs/rustfs/pull/3254
- fix(tier): recover by @mbartsch in https://github.com/rustfs/rustfs/pull/3182
- ci: stabilize architecture layer guard by @overtrue in https://github.com/rustfs/rustfs/pull/3255
- docs: add startup timeline baseline by @overtrue in https://github.com/rustfs/rustfs/pull/3256
- docs: add admin route action snapshot by @overtrue in https://github.com/rustfs/rustfs/pull/3258
- docs: inventory ecstore config consumers by @overtrue in https://github.com/rustfs/rustfs/pull/3259
- feat(table-catalog): tighten REST load/register compatibility by @marshawcoco in https://github.com/rustfs/rustfs/pull/3245
- docs: complete config helper inventory by @overtrue in https://github.com/rustfs/rustfs/pull/3261
- docs: update security advisory lessons by @overtrue in https://github.com/rustfs/rustfs/pull/3262
- fix(ci): install ripgrep for script checks by @overtrue in https://github.com/rustfs/rustfs/pull/3260
- fix(replication): repair site replication setup by @reatang in https://github.com/rustfs/rustfs/pull/3252
- fix(ecstore): add disk validation diagnostics by @houseme in https://github.com/rustfs/rustfs/pull/3265
- fix(lifecycle): harden scanner ILM expiry accounting by @marshawcoco in https://github.com/rustfs/rustfs/pull/3257
- ci: add architecture migration rule checks by @overtrue in https://github.com/rustfs/rustfs/pull/3264
- test: add admin route matrix guard by @overtrue in https://github.com/rustfs/rustfs/pull/3268
- feat: add security governance contract types by @overtrue in https://github.com/rustfs/rustfs/pull/3270
- feat(table-catalog): add metadata maintenance cleanup by @marshawcoco in https://github.com/rustfs/rustfs/pull/3266
- fix(ecstore): gate rustix fs diagnostics on windows by @houseme in https://github.com/rustfs/rustfs/pull/3267
- fix: return 503 on lock contention instead of 500 by @overtrue in https://github.com/rustfs/rustfs/pull/3274
- feat: add security governance policy contracts by @overtrue in https://github.com/rustfs/rustfs/pull/3271
- feat(table-catalog): add recovery diagnostics by @marshawcoco in https://github.com/rustfs/rustfs/pull/3275
- fix(scanner): publish partial usage for compacted scans by @marshawcoco in https://github.com/rustfs/rustfs/pull/3277
- fix(ecstore): avoid offline disks on admin timeout by @cxymds in https://github.com/rustfs/rustfs/pull/3263
- perf(ecstore): improve erasure write diagnostics and single-block performance by @houseme in https://github.com/rustfs/rustfs/pull/3280
- feat(helm): add option to disable log PVCs and mounts by @rudxde in https://github.com/rustfs/rustfs/pull/3189
- fix(ecstore): harden rebalance data movement by @cxymds in https://github.com/rustfs/rustfs/pull/3234
- feat(rio): rio_v2 is compatible with minio for storing data. by @reatang in https://github.com/rustfs/rustfs/pull/3115
- feat(replication): expose scanner repair outcomes by @marshawcoco in https://github.com/rustfs/rustfs/pull/3278
- fix(scanner): ignore missing rebalance metadata by @cxymds in https://github.com/rustfs/rustfs/pull/3282
- feat(table-catalog): refine table catalog permissions by @marshawcoco in https://github.com/rustfs/rustfs/pull/3283
- refactor(zip): simplify archive extraction path by @houseme in https://github.com/rustfs/rustfs/pull/3290
- build: upgrade Rust baseline to 1.96.0 by @houseme in https://github.com/rustfs/rustfs/pull/3291
- feat: add admin route policy inventory by @overtrue in https://github.com/rustfs/rustfs/pull/3286
- feat(table-catalog): support standard REST create commit by @marshawcoco in https://github.com/rustfs/rustfs/pull/3287
- feat(heal): expose scanner heal admission outcomes by @marshawcoco in https://github.com/rustfs/rustfs/pull/3292
- feat: add KMS action taxonomy by @overtrue in https://github.com/rustfs/rustfs/pull/3294
- feat(table-catalog): internalize catalog backing paths by @marshawcoco in https://github.com/rustfs/rustfs/pull/3295
- feat(kms): migrate KMS handlers to dedicated actions by @overtrue in https://github.com/rustfs/rustfs/pull/3298
- fix(config): accept Kafka SASL keys in legacy admin by @cxymds in https://github.com/rustfs/rustfs/pull/3300
- feat(heal): add scanner-aware bitrot controls by @marshawcoco in https://github.com/rustfs/rustfs/pull/3297
- Refactor(CLI): avoid unnecessary
unreachable!macro in CLI parsing by @Tirka in https://github.com/rustfs/rustfs/pull/3288 - feat(helm): add priorityClassName attribute by @jperville in https://github.com/rustfs/rustfs/pull/3301
- feat(table-catalog): add metadata maintenance control plane by @marshawcoco in https://github.com/rustfs/rustfs/pull/3302
- feat(kms): add KMS config redaction safeguards by @overtrue in https://github.com/rustfs/rustfs/pull/3303
- @mbartsch made their first contribution in https://github.com/rustfs/rustfs/pull/3182
- @Tirka made their first contribution in https://github.com/rustfs/rustfs/pull/3288
- @jperville made their first contribution in https://github.com/rustfs/rustfs/pull/3301
Full Changelog: https://github.com/rustfs/rustfs/compare/1.0.0-beta.7...1.0.0-beta.8
9.4.2
QuestDB 9.4.2 is a hardening release that builds on 9.4.1, driven by continued fuzz testing and stricter query-result assertions. The posting and covering index introduced in 9.4.0 gets the most attention: this release fixes incorrect results from indexed reads and a crash on specific partition-maintenance paths, and reclaims an on-disk file leak. On the Parquet side, one fix keeps a table from being suspended when an all-null column is converted back to native form, and others harden reads of malformed or foreign files. The remaining fixes span temporal joins, GROUP BY, SELECT DISTINCT, and aggregates. The release also upgrades the web console to 1.2.3.
Two behavior changes are worth noting before upgrading: a bare INDEX TYPE POSTING is now non-covering by default, and SHOW CREATE TABLE now rejects views and materialized views. Both are detailed below.
For any questions or feedback, please join us on Slack or on Discourse.
See also our prettier release notes page.
- A bare
INDEX TYPE POSTING(noINCLUDE) is now non-covering. In 9.4.0–9.4.1 a posting index declared without an explicitINCLUDEclause silently auto-appended the designated timestamp to its covering set, turning it into a covering index — an unintended default. From 9.4.2, a posting index with noINCLUDEis non-covering; the timestamp auto-include (cairo.posting.index.auto.include.timestamp, still defaulttrue) now only rounds out an explicitINCLUDEset and never makes a non-covering index covering on its own. Existing tables are unaffected — the covering flag is persisted per-column in_metaand read back unchanged — so this changes only newly created or re-declared indexes.SHOW CREATE TABLEnow renders such a column asINDEX TYPE POSTINGrather thanINDEX TYPE POSTING INCLUDE (ts), and aWHERE sym = ...predicate takes the plain posting-filter cursor instead of the covering cursor. (#7203) SHOW CREATE TABLEnow rejects views and materialized views. Previously it rendered a misleadingCREATE TABLEstatement for any object kind; executing that DDL would have created a plain table rather than the view. It now errors withtable name expected, got view or materialized view name. UseSHOW CREATE VIEW/SHOW CREATE MATERIALIZED VIEWfor those objects. The sibling statements now also name the actual object kind in their mismatch errors. (#7208)
Upgraded to 1.2.3 (#7199):
- Share links to queries from the editor dropdown and via keyboard shortcuts.
- Storage policy now shows in table details and is supported in the "create materialized view" quick action.
- Fixed stale user and data after SSO logout.
- Increased the query-validation debounce time.
- Fixed a use-after-free crash (SIGSEGV) on random access over a Parquet partition — for example a query with
LIMITover a Parquet-backed scan. (#7195) - Fixed a
ClassCastExceptioncrash in parallel keyed GROUP BY reading through a covering index. (#7150) - Fixed crashes in ASOF/LT joins between
STRING/VARCHARandSYMBOLkeys, on both the full-fat and Light paths. (#7150) - Fixed an assertion crash when a NULL array value is used as a GROUP BY map key. (#7150)
- Fixed an aggregate (
count(),sum(), ...) over aUNION ALLof aliased sub-queries crashing query compilation with an internal error (a 500 in the web console).UNIONcolumns are now matched by position; the previous by-name matching was silently wrong for differently-aliased branches. Acairo.sql.legacy.union.column.propagationflag (defaultfalse) restores the old behavior as an operational rollback. (#7210) - Fixed an ASOF join (Dense algorithm) dropping matches when its cursor is read more than once — for example by a window function, a cached factory re-running the query, or a parent operator. (#7195)
- Fixed
<symbols> IN (...) LATEST ON tsover a multi-partition table returning rows not ordered by the designated timestamp. (#7195) - Fixed
count()over a keyed GROUP BY subquery filtered on the aggregate alias (a HAVING-style predicate) reporting phantom duplicate groups that do not exist. (#7202) - Fixed
count(*)and full-scan size calculation throwing instead of contributing zero rows when an empty partition is absent from disk — for example one omitted by a backup or restore. (#7195) - Fixed
LIMIT lo, hiand result-size calculation over a cross join with an unknown-size input counting or skipping too few rows. (#7195) - Fixed compile-time failures (
Invalid column,ArrayIndexOutOfBoundsException) onSELECT DISTINCTand GROUP BY queries with qualified (t.col), duplicated, or constant-aliased projections. (#7150) - Fixed
last()/mode()over a constantSYMBOLreturning the constant instead of NULL. (#7150) - Fixed wrong JIT-filter results when a
LONGvalue appears only as a literal inside narrow-integer arithmetic; the JIT path now matches the scalar path at 64-bit width. (#7150) - Fixed native-memory leaks: posting-index reader buffers stranded when a row cursor errors mid-iteration, and per-worker array GROUP BY keys orphaned under a mixed thread-safe / non-thread-safe key set. (#7150)
INnow accepts IPv4 list literals, e.g.addr IN ('1.2.3.4'::ipv4, '5.6.7.8'::ipv4), instead of failing to compile. (#7150)
- Fixed a JVM crash (covering index) or missing/short indexed counts (non-covering index) after a partition squash, an in-range O3 commit, or a WAL auto-squash that spills past the indexer budget on a hot key. (#7203)
- Fixed covered reads returning NULL for a whole partition after an O3 or squash reseal of a Parquet partition carrying a covering posting index. (#7203)
- Fixed an incomplete covered sidecar on the WAL fast-lag apply path when a mid-stream spill flush occurred during indexing, which could over-read on a later covered read. (#7203)
- Fixed the covering configuration being lost after
ALTER TABLE ... ALTER COLUMN ... SYMBOL CAPACITY, which silently demoted the posting index to non-covering for all later readers. (#7203) - Fixed an on-disk value-file (
.pv) leak when a Parquet index reseal spilled; the superseded intermediate file is now reclaimed through the writer's scoreboard-gated purge queue. (#7203) - Hardened the Parquet seal-purge state with a single leaf lock, so the concurrent O3-worker and writer-thread paths are safe by construction rather than by thread-join timing. (#7203)
- Fixed a Parquet read failure on an all-null integer column (
INT/LONG) page that usedDELTA_BINARY_PACKEDencoding. The failure surfaced on an eager, full-row-group read — converting a Parquet partition back to native, or WAL apply re-running that conversion, notably under replication where it suspended the table on both primary and replica — while a lazySELECTover the same partition was unaffected. Files already written by affected versions stay readable; newly written files carry a valid header. There is no format or version bump. (#7212) - Hardened the Parquet reader against malformed or foreign-produced files reachable through the
read_parquet()function and partition conversion: a range of inputs (out-of-range delta bit widths, badDELTA_BINARY_PACKEDheaders, integer-overflowing miniblock sizes, oversized varint values) that previously aborted the JVM via a Rust panic now return a clean error instead. Valid files decode exactly as before. (#7212)
- chore(ui): upgrade web console to 1.2.3 by @emrberk in #7199
- fix(core): fix posting index crash and missing rows after partition squash by @nwoolmer in #7203
- fix(core): fix all-null Parquet column reads and crashes on malformed files by @glasstiger in #7212
- fix(sql): fix wrong results and memory leaks in posting-index, join and group-by queries by @puzpuzpuz in #7150
- fix(sql): fix a parquet query crash and wrong results in latest-by, ASOF joins, and counts by @bluestreak01 in #7195
- fix(sql): fix count() over a GROUP BY subquery reporting phantom duplicates by @ideoma in #7202
- fix(sql): fix UNION ALL column mismatch under aggregates by @nwoolmer in #7210
- fix(sql): reject views and materialized views in SHOW CREATE TABLE by @nwoolmer in #7208
Full Changelog: 9.4.1...9.4.2
OpenSSL 3.0.21
OpenSSL 3.0.21 is a security patch release. The most severe CVE fixed in this release is High.
This release incorporates the following bug fixes and mitigations:
-
Fixed heap use-after-free in
PKCS7_verify(). (CVE-2026-45447) -
Fixed CMS
AuthEnvelopedDataprocessing may accept forged messages. (CVE-2026-34182) -
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445) -
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
-
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
-
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
-
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
-
Fixed FFC-DH peer validation uses attacker-supplied
q. (CVE-2026-42770) -
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)
OpenSSL 3.4.6
OpenSSL 3.4.6 is a security patch release. The most severe CVE fixed in this release is High.
This release incorporates the following bug fixes and mitigations:
-
Fixed heap use-after-free in
PKCS7_verify(). (CVE-2026-45447) -
Fixed CMS
AuthEnvelopedDataprocessing may accept forged messages. (CVE-2026-34182) -
Fixed unbounded memory growth in the QUIC
PATH_CHALLENGEhandler. (CVE-2026-34183) -
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445) -
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
-
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
-
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
-
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
-
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
-
Fixed multi-
RecipientInfoBleichenbacher Oracle inCMS_decrypt()andPKCS7_decrypt(). (CVE-2026-42768) -
Fixed trust anchor substitution via
cert/issuertypo in CMProotCaKeyUpdate. (CVE-2026-42769) -
Fixed FFC-DH peer validation uses attacker-supplied
q. (CVE-2026-42770) -
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)
OpenSSL 3.5.7
OpenSSL 3.5.7 is a security patch release. The most severe CVE fixed in this release is High.
This release incorporates the following bug fixes and mitigations:
-
Fixed heap use-after-free in
PKCS7_verify(). (CVE-2026-45447) -
Fixed CMS
AuthEnvelopedDataprocessing may accept forged messages. (CVE-2026-34182) -
Fixed unbounded memory growth in the QUIC
PATH_CHALLENGEhandler. (CVE-2026-34183) -
Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)
-
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445) -
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
-
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
-
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
-
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
-
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
-
Fixed NULL pointer dereference in CRMF
EncryptedValuedecryption. (CVE-2026-42767) -
Fixed multi-
RecipientInfoBleichenbacher Oracle inCMS_decrypt()andPKCS7_decrypt(). (CVE-2026-42768) -
Fixed trust anchor substitution via
cert/issuertypo in CMProotCaKeyUpdate. (CVE-2026-42769) -
Fixed FFC-DH peer validation uses attacker-supplied
q. (CVE-2026-42770) -
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)
OpenSSL 3.6.3
OpenSSL 3.6.3 is a security patch release. The most severe CVE fixed in this release is High.
This release incorporates the following bug fixes and mitigations:
-
Fixed heap use-after-free in
PKCS7_verify(). (CVE-2026-45447) -
Fixed CMS
AuthEnvelopedDataprocessing may accept forged messages. (CVE-2026-34182) -
Fixed unbounded memory growth in the QUIC
PATH_CHALLENGEhandler. (CVE-2026-34183) -
Fixed double-free when checking OCSP stapled response. (CVE-2026-35188)
-
Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)
-
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445) -
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
-
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
-
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
-
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
-
Fixed NULL dereference in certificate verification with OCSP Checking. (CVE-2026-42765)
-
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
-
Fixed NULL pointer dereference in CRMF
EncryptedValuedecryption. (CVE-2026-42767) -
Fixed multi-
RecipientInfoBleichenbacher Oracle inCMS_decrypt()andPKCS7_decrypt(). (CVE-2026-42768) -
Fixed trust anchor substitution via
cert/issuertypo in CMProotCaKeyUpdate. (CVE-2026-42769) -
Fixed FFC-DH peer validation uses attacker-supplied
q. (CVE-2026-42770) -
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)
OpenSSL 4.0.1
OpenSSL 4.0.1 is a security patch release. The most severe CVE fixed in this release is High.
This release incorporates the following bug fixes and mitigations:
-
Fixed heap use-after-free in
PKCS7_verify(). (CVE-2026-45447) -
Fixed CMS
AuthEnvelopedDataprocessing may accept forged messages. (CVE-2026-34182) -
Fixed unbounded memory growth in the QUIC
PATH_CHALLENGEhandler. (CVE-2026-34183) -
Fixed double-free when checking OCSP stapled response. (CVE-2026-35188)
-
Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)
-
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445) -
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
-
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
-
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
-
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
-
Fixed NULL dereference in certificate verification with OCSP Checking. (CVE-2026-42765)
-
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
-
Fixed NULL pointer dereference in CRMF
EncryptedValuedecryption. (CVE-2026-42767) -
Fixed multi-
RecipientInfoBleichenbacher Oracle inCMS_decrypt()andPKCS7_decrypt(). (CVE-2026-42768) -
Fixed trust anchor substitution via
cert/issuertypo in CMProotCaKeyUpdate. (CVE-2026-42769) -
Fixed FFC-DH peer validation uses attacker-supplied
q. (CVE-2026-42770) -
Fixed possible out of bounds read in
X509_VERIFY_PARAM_set1_email(). (CVE-2026-42771) -
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446)
-
Fixed a regression introduced in 4.0.0 that led to a
openssl pkeycommand crash when it was invoked to encrypt a private key with password being provided interactively. -
Fixed a regression introduced in 4.0.0 that led to
openssl s_client -advcommand prematurely terminating a session when reading input of 16384 bytes in oneread()call.