OpenSSL 3.5: What's New, Release History & EOL Status

What Is New in OpenSSL 3.5

What new cryptographic algorithms does OpenSSL 3.5 introduce?

OpenSSL 3.5 adds post-quantum cryptography (PQC) primitives and makes them first-class TLS participants.

• ML-KEM (including X25519MLKEM768 hybrid groups) for key-exchange.
• ML-DSA and SLH-DSA for signatures.
• Support for opaque symmetric key objects (EVP_SKEY) that can hold PQC keys without exposing raw material.

In practice this means you can configure a server to prefer a hybrid group such as X25519MLKEM768 and still interoperate with classic clients that only understand X25519.

# openssl.conf snippet
[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
default_groups = X25519MLKEM768:X25519

How have TLS defaults changed in OpenSSL 3.5?

The default TLS supported groups list now prefers hybrid PQC KEM groups and drops rarely used classic groups.

• Hybrid groups (e.g., X25519MLKEM768) are offered before pure classic groups.
• Default keyshare extension automatically includes X25519MLKEM768 and X25519, reducing round-trips for PQC-capable clients.
• A new configuration option no-tls-deprecated-ec disables the legacy groups deprecated in RFC 8422.

This matters if you rely on legacy groups such as secp256r1; you may need to add them back explicitly:

# openssl.conf addition
default_groups = X25519MLKEM768:X25519:secp256r1

What are the major FIPS provider updates in OpenSSL 3.5?

The FIPS provider now enforces a provenance-check-test (PCT) on key import for RSA, EC, and ECX keys and adds a PCT for DH key generation.

• RSA, EC, ECX keys imported via EVP_PKEY_new() are validated against the FIPS-approved algorithm set.
• DH key generation now includes a mandatory self-test before the key is usable.
• The enable-fips-jitter configuration option allows the FIPS provider to use the JITTER entropy source.

Watch out for deployment scripts that previously imported raw keys without error handling; they must now check for EVP_PKEY_imported failures.

Which APIs were deprecated or changed in OpenSSL 3.5?

All BIO_meth_get_*() functions have been deprecated and will be removed in a future major release.

• Replace calls to BIO_meth_get_write() with the generic BIO_method_get_write() wrapper.
• The default encryption cipher for the req, cms, and smime utilities switched from des-ede3-cbc to aes-256-cbc.

Most teams can continue to use the utilities unchanged, but scripts that explicitly set -cipher des-ede3-cbc should be reviewed.

# old usage
openssl req -new -key key.pem -cipher des-ede3-cbc -out req.csr

# new default (no -cipher needed)
openssl req -new -key key.pem -out req.csr

What critical bugs were fixed across the OpenSSL 3.5 series?

The 3.5 series addressed a wide range of security issues, from memory safety to protocol handling.

• RSA KEM RSASVE encapsulation now correctly reports failures (CVE-2026-31790).
• DANE client code no longer suffers a use-after-free (CVE-2026-28387).
• Delta CRL processing fixed a NULL-pointer dereference (CVE-2026-28388).
• CMS recipient parsing now validates pointers for both KeyAgree and KeyTransport info (CVE-2026-28389, CVE-2026-28390).
• Hexadecimal conversion buffer overflow patched (CVE-2026-31789).
• Multiple CVEs in earlier 3.5.x releases were also remediated, covering PKCS#12 MAC validation, CMS AuthEnvelopedData parsing, TLS 1.3 CompressedCertificate handling, and more.

In production, ensure you are running at least 3.5.6 to benefit from the latest mitigations.