OpenSSL: supported versions and how to update safely

Updated November 2026

OpenSSL is the TLS and crypto library behind most web, mail, VPN and database servers. Patch it with your distribution's packages, then restart every process that loaded the old library. Updating the files on disk is not enough. As of November 3, 2026, upstream supports 3.5 (LTS), 4.0 and 4.1.

• 3.5.9Latest 3.5 LTS, supported to April 8, 2030
• 4.0.3Latest 4.0, supported to May 14, 2027
• 4.1.0Released October 23, 2026
• 14CVEs fixed on September 29, 2026 (1 high)

What OpenSSL is

OpenSSL has two libraries, libssl (the TLS protocol) and libcrypto (ciphers, hashes, certificates), plus the openssl command-line tool. nginx, Apache httpd, Postfix, Dovecot, PHP, Python, many databases and OpenSSH's sshd load it. One library update therefore touches many services, which is why the restart step matters more here than for any other package.

Supported versions

The rules, from the OpenSSL release strategy: a long-term support (LTS) release comes every two years and gets at least five years, with only security fixes in the last year. Non-LTS releases after 3.5 get 13 months. Extended support for 3.0, 1.1.1 and 1.0.2 is sold by OpenSSL Corporation. The 4.1 end date comes from the OpenSSL downloads page.

Distro packages and backports

Distributions keep one OpenSSL branch for a release's whole life and backport fixes into it. Ubuntu 24.04, for example, still ships 3.0.13, a branch upstream dropped, and Canonical keeps patching it. That is fine while your distribution release is supported. Judge the package version, not the upstream number.

Upstream fixed this flaw in 3.5.9, yet Debian 13's fixed package is called 3.5.7: the patch was backported. The same advisory batch fixed 13 more CVEs, mostly low severity and mostly in QUIC, DTLS, CMP and SM2 code.

Find which OpenSSL each program uses

openssl version -a                              # the CLI tool and its library
ldd "$(command -v nginx)" | grep -E 'libssl|libcrypto'   # what a binary links to
ldconfig -p | grep -E 'libssl|libcrypto'        # libraries the loader knows about
sudo find / -xdev \( -name 'libssl.so*' -o -name 'libcrypto.so*' \) 2>/dev/null

Extra copies in /usr/local, /opt or an application folder are not updated by the package manager. Some software bundles its own OpenSSL: Node.js does (node -p process.versions.openssl), and every container image has its own. See Node.js and containers.

Update commands

# Debian 13, Ubuntu 24.04 and later (libssl3 on Debian 12 and Ubuntu 22.04)
sudo apt update
sudo apt install --only-upgrade openssl libssl3t64

# RHEL, Rocky, AlmaLinux, Oracle Linux, Amazon Linux 2023
sudo dnf upgrade --refresh openssl openssl-libs

# SUSE: list, then install the pending patches
sudo zypper refresh
sudo zypper list-patches | grep -i openssl
sudo zypper patch

# Alpine (as root)
apk -U upgrade libssl3 libcrypto3     # add openssl if the CLI is installed

# FreeBSD base system (as root): distribution sets, or pkgbase on 15.0 and later
freebsd-update fetch install
pkg upgrade -r FreeBSD-base

On FreeBSD use only one of the two base-update commands, the one that matches how the system was installed (see FreeBSD). For containers, rebuild the image from an updated base image and recreate the container.

Restart everything that uses it

This lists every process that still maps a deleted (old) copy of the library:

for f in $(sudo grep -lE '(libssl|libcrypto).*\(deleted\)' /proc/[0-9]*/maps 2>/dev/null); do
  pid=${f#/proc/}; pid=${pid%/maps}
  ps -o pid=,comm= -p "$pid"
done

Distribution tools do the same check by service name: sudo needrestart -r l on Debian and Ubuntu, sudo dnf needs-restarting -s on the RHEL family, and sudo zypper ps -s on SUSE. Restart each service listed, for example sudo systemctl restart nginx postfix (this restarts those services). For sshd, keep your current session open and test a new login before you log out. The FreeBSD advisory puts it simply: "Restart all daemons that use the library, or reboot the system." If many services are affected, a reboot is the simplest choice. More in restarting after an update.

If you build OpenSSL yourself

Do this only when an application needs a newer branch than your distribution ships. Never install over the system library in /usr. Install into its own prefix and link your application to it:

gpg --verify openssl-3.5.9.tar.gz.asc openssl-3.5.9.tar.gz
./Configure --prefix=/opt/openssl-3.5 --openssldir=/opt/openssl-3.5/ssl
make && make test
sudo make install

Current releases are signed by the key with fingerprint B146 647E 45A7 B339 47AB 226B 2A2C 87D1 6169 2D40; import it from the downloads page first. Choose 3.5 LTS unless you need 4.x features. You now own this copy: watch every advisory and rebuild it, and the programs linked to it, for each fix.

Where advisories appear

• OpenSSL vulnerabilities: every CVE with severity and the fixed version in each branch.
• The read-only openssl-announce list for official announcements (see OpenSSL mailing lists), and the release and advisory timeline.
• Your distribution's advisories, which say when the backported fix is ready. Our vulnerability pages track the important ones.

Quick hardening tips

• Allow only TLS 1.2 and 1.3 in each server (ssl_protocols in nginx, SSLProtocol in Apache, see nginx).
• Keep one OpenSSL per host where you can, and remove stray builds you no longer need.
• Keep a list of software that bundles its own OpenSSL and patch it on the same day.
• Don't lower the default security level (no @SECLEVEL=0 in cipher strings).
• Keep private keys readable only by root or the service account (chmod 600).
• Check what a server actually negotiates: openssl s_client -connect example.com:443 -brief </dev/null.
• Move off OpenSSL 1.1.1 or 3.0 builds that come from outside a supported distribution.

Sources

• Release strategy, OpenSSL Library
• Downloads, OpenSSL Library
• Versioning policy, OpenSSL Library
• OpenSSL 4.0 final release, OpenSSL Library
• Vulnerabilities, OpenSSL Library
• Release and advisory timeline, OpenSSL Library
• Mailing lists, OpenSSL Library
• CVE-2026-84782, Debian Security Tracker
• CVE-2026-84782, Ubuntu Security
• openssl package versions, Debian
• openssl package versions, Ubuntu
• openssl package, Alpine Linux v3.24
• FreeBSD-SA-26:68.openssl, The FreeBSD Project