OpenSSL Fixed 14 Vulnerabilities on September 29: 3.0 Fixes Are for Paying Customers Only, and 3.4 Support Ends October 22

On September 29, 2026, OpenSSL published a security advisory fixing 14 CVEs at once: one High, one Moderate and twelve Low. The fixed releases are 4.0.3, 3.6.5, 3.5.9 and 3.4.8. The line worth noticing is the small print: the fixes for 3.0, 1.1.1 and 1.0.2 (3.0.23, 1.1.1zj and 1.0.2zs) are marked "Premium support customers only".

The High and the Moderate

• High, CVE-2026-84782: the DTLS retransmission logic mishandles a handshake message write that is suspended part-way through, so a retransmission can disclose heap memory to the peer as plaintext handshake data, or crash when it reads into unmapped memory. All of 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are affected. The advisory describes only the DTLS path. DTLS is TLS over UDP, while an ordinary HTTPS site uses TLS over TCP; if any of your services use DTLS, handle this one first.
• Moderate, CVE-2026-84783: a use-after-free in the X.509 extension cache on first concurrent use, which lets a remote, unauthenticated peer crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates. Only 4.0 is affected; 3.6 and earlier are not.
• The other 12, all Low, cover CRL processing, QUIC, timing side channels in elliptic-curve arithmetic and more.

The Real Change Is in the Support Windows

OpenSSL's own release-strategy page spells it out:

• 3.4 is supported until October 22, 2026, and 3.6 until November 1, 2026;
• 3.5 is the long-term support (LTS) release, supported until April 8, 2030; 4.0 is supported until May 14, 2027;
• 3.0, 1.1.1 and 1.0.2 are no longer supported, with security fixes available only through paid extended support; 3.1, 3.2 and 3.3 are out of support and were not analysed for this advisory.

What This Means for a VPS

Many systems still ship the 3.0 series: Ubuntu 22.04, Ubuntu 24.04 and Debian 12 all do. With upstream no longer publishing 3.0 fixes, security updates depend entirely on distributions backporting them. The status as we found it on October 12:

• Ubuntu has shipped updates for the High bug: 3.0.2-0ubuntu1.30 on 22.04, 3.0.13-0ubuntu3.16 on 24.04 and 3.5.5-1ubuntu3.6 on 26.04; fixes for 20.04 and 18.04 require Ubuntu Pro.
• Debian 13 is fixed via DSA-6531-1 (3.5.7-1~deb13u3); Debian 12 is still marked vulnerable on the security tracker.

What to do: check the system library with openssl version, look for pending openssl / libssl updates with apt list --upgradable, and after installing them restart every service that uses TLS (Nginx, databases, mail and so on) — otherwise the running processes keep the old library loaded. If you built OpenSSL 3.4 yourself and linked it statically, there will be no upstream fixes after October 22, so move to the 3.5 LTS soon; 3.5 is also the release with native ML-KEM support that we covered in our post-quantum TLS article. When choosing a system, stick to long-term-support releases still inside their support window — choosing a VPS operating system compares them, and our piece on the 24.04-to-26.04 upgrade covers Ubuntu's upgrade path. For certificates and HTTPS setup, see configuring a Let's Encrypt SSL certificate.