news
OpenSSL 3.6.2 Is Now Available for Download with Important Security Fixes
OpenSSL 3.6.2 is here two and a half months after OpenSSL 3.6.1 to address several important security vulnerabilities, including incorrect failure handling in RSA KEM RSASVE encapsulation (CVE-2026-31790) and an out-of-bounds read in AES-CFB-128 on x86-64 CPUs with AVX-512 support (CVE-2026-28386).
It also patches a potential use-after-free in DANE client code (CVE-2026-28387), a NULL pointer dereference when processing a delta CRL (CVE-2026-28388), and a possible NULL dereference when processing CMS KeyAgreeRecipientInfo (CVE-2026-28389).