@@ -28,6 +28,296 @@ OpenSSL Releases
 OpenSSL 3.5
 -----------
 
+### Changes between 3.5.8 and 3.5.9 [29 Sep 2026]
+
+ * Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
+
+   Severity: High
+
+   Issue summary: The DTLS retransmission logic does not correctly handle
+   a handshake message write that is suspended part-way through.
+   The retransmitted message can be read past the message buffer
+   and the retransmission overwrites the internal state the suspended write
+   needs to resume correctly.
+
+   Impact summary: The retransmitted message can disclose a heap memory
+   to the peer as plaintext handshake data or cause a crash and a Denial
+   of Service when the read reaches an unmapped memory region.
+
+   Reported by: Laurent Gaffie (secorizon.com).
+
+   ([CVE-2026-84782])
+
+   *Ryan Hooper*
+
+ * Fixed excessive memory allocation in relative CRLDP processing.
+
+   Severity: Low
+
+   Issue summary: A certificate with many `nameRelativeToCRLIssuer` CRL
+   distribution points causes disproportionate heap growth when OpenSSL caches
+   X.509 extensions.
+
+   Impact summary: Receiving a crafted certificate from a malicious peer
+   can lead to significant memory pressure and possible Denial of Service
+   in clients or in servers that solicit client certificates.
+
+   Reported by: Fuzz0x (ZKSC Institute of Security Research).
+
+   ([CVE-2026-35189])
+
+   *Viktor Dukhovni*
+
+ * Fixed QUIC unvalidated amplification credit may be over-accounted.
+
+   Severity: Low
+
+   Issue summary: The OpenSSL QUIC server, when configured to not preform
+   address validation, can be forced to count incoming packets multiple times
+   in its unvalidated credit computation, leading to a violation
+   of the [RFC 9000] unvalidated connection amplification limit of 3 times
+   the amount of data received.
+
+   Impact summary: A remote attacker, who is able to spoof packets to a server
+   using the OpenSSL QUIC implementation, might use the server
+   for an amplification of a Distributed Denial of Service attack.
+
+   Reported by: Ali Firas and Nikolas Gauder (NVIDIA).
+
+   ([CVE-2026-35191])
+
+   *Neil Horman*
+
+ * Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
+
+   Severity: Low
+
+   Issue summary: The QUIC stream reassembly algorithm performance deteriorates
+   progressively as packets are arriving out of order.  The worst case has
+   a quadratic complexity, proportional to the number of stream frames kept
+   in the buffer for the received stream data.
+
+   Impact summary: A remote QUIC peer that completes the handshake can create
+   a connection-scoped CPU pressure and potentially a Denial of Service using
+   compliant `STREAM` frames inside the advertised receive window, with low
+   attacker bandwidth.
+
+   Reported by: Saku0512 and Opal Wright (Trail of Bits) in collaboration
+   with OpenAI
+
+   ([CVE-2026-42772])
+   <!-- https://github.com/openssl/openssl/pull/32769 -->
+
+   *Alexandr Nedvědický*
+
+ * Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
+
+   Severity: Low
+
+   Issue summary: The generic elliptic-curve scalar multiplication, used
+   for ECDSA and SM2 signature operations with curves that do not have
+   a dedicated implementation, leaks information about the secret nonce
+   through timing.
+
+   Impact summary: An attacker, who is able to measure signing times, may learn
+   information about the per-signature secret nonce, which over many signatures
+   can, via a Hidden Number Problem (lattice) attack, lead to recovery
+   of the private key.
+
+   Reported by: Alicja Kario and George Pantelakis (Red Hat), based
+   on the report of Youngjae Choi (Korea University).
+
+   ([CVE-2026-54872])
+
+   *Igor Ustinov*
+
+ * Fixed QUIC `STREAM` fragment metadata DoS.
+
+   Severity: Low
+
+   Issue summary: QUIC process may keep memory for QUIC packet buffer
+   for much longer period than necessary.
+
+   Impact summary: Remote peer can exploit this vulnerability by sending
+   maliciously crafted packets, making the local QUIC stack to keep the memory
+   for packet buffers allocated.  The time for which the memory remains
+   allocated is entirely under the control of the potentially malicious remote
+   peer.
+
+   Reported by: Zhen Yan (AntAISecurityLab) and Bhabani Sankar Das.
+
+   ([CVE-2026-54873])
+   <!-- https://github.com/openssl/openssl/pull/32769 -->
+
+   *Alexandr Nedvědický*
+
+ * Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
+
+   Severity: Low
+
+   Issue summary: A non-constant-time optimized implementation of scalar
+   point multiplication is used for SM2 private key operations on ARM64
+   and RISC-V platforms.
+
+   Impact summary: An attacker able to measure the time taken by, or to observe
+   the cache-line access pattern of, SM2 signing or decryption on an affected
+   platform can learn information about the secret scalar.
+
+   Reported by: Abhinav Agarwal and Feng Xue.
+
+   ([CVE-2026-54875])
+
+   *Igor Ustinov*
+
+ * Fixed out-of-bounds access after `SSL_set_SSL_CTX()` during a handshake.
+
+   Severity: Low
+
+   Issue summary: A TLS server that calls `SSL_set_SSL_CTX()` to switch
+   a connection to a different `SSL_CTX` part way through a handshake may access
+   memory beyond the end of an internal array if the replacement context knows
+   about more provider signature algorithms than the context the connection was
+   created from.  Applications that never call `SSL_set_SSL_CTX()`
+   are not affected.
+
+   Impact summary: A remote peer may be able to cause a small out-of-bounds
+   read, and, in some circumstances, a fixed-value out-of-bounds write,
+   on the server heap.  This may lead to a Denial of Service.
+
+   Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
+   Brandon Luo, Luigino Camastra (Aisle Research), and Bhargava Shastry.
+
+   ([CVE-2026-72897])
+
+   *Matt Caswell*
+
+ * Fixed QUIC connection-level flow control was not enforced for streams.
+
+   Severity: Low
+
+   Issue summary: OpenSSL QUIC stack does not enforce connection-level flow
+   control for streams.  Remote peers may send more bytes, as long as they fit
+   within the stream flow control limits.
+
+   Impact summary: A malicious remote peer may exploit the lack of connection
+   flow control for streams to make the QUIC stack receive ~100 MiB of memory
+   instead of 768 KiB (default flow control window size).
+
+   Reportedby: Moltenbit, Bhabani Sankar Das, Saiyowa Security Team, mzfr.
+
+   ([CVE-2026-75804])
+
+   *Alexandr Nedvědický*
+
+ * Fixed a NULL pointer dereference in CMP client revocation response handling.
+
+   Severity: Low
+
+   Issue summary: The OpenSSL Certificate Management Protocol (CMP) client
+   that requests a certificate revocation on the basis of a PKCS#10 CSR may
+   dereference a NULL pointer and terminate abnormally when processing a crafted
+   revocation response.
+
+   Impact summary: The NULL pointer dereference happens on a read, which
+   leads to a crash and a Denial of Service for the affected client application.
+
+   Reported by: Bhabani Sankar Das.
+
+   ([CVE-2026-75805])
+
+   *Bhabani Sankar Das and Norbert Pócs*
+
+ * Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
+
+   Severity: Low
+
+   Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
+   can be terminated by a single unauthenticated datagram whose encrypted
+   fragment is shorter than the mandatory explicit IV and authentication tag
+   overhead.
+
+   Impact summary: An attacker who can send a datagram that is routed
+   to an existing DTLS 1.2 association can tear that association down
+   without knowing any key material.  This is a Denial of Service, limited
+   to the targeted association.  There is no memory safety or confidentiality
+   impact.
+
+   Reported by: Mounir IDRASSI.
+
+   ([CVE-2026-75806])
+
+   *Mounir IDRASSI*
+
+ * Fixed a timing side-channel in SM2 signature generation.
+
+   Severity: Low
+
+   Issue summary: SM2 signature generation uses non-constant-time arithmetic
+   on secret values, forming a timing side-channel.
+
+   Impact summary: An attacker able to measure SM2 signing times may learn
+   information about the per-signature secret nonce, which over many signatures
+   can, via a Hidden Number Problem (lattice) attack, lead to recovery
+   of the private key.
+
+   Reported by: Vladimir Tokarev.
+
+   ([CVE-2026-77696])
+
+   *Igor Ustinov and Viktor Dukhovni*
+
+ * Fixed an unbounded `RETIRE_CONNECTION_ID` backlog in QUIC stack
+   implementation.
+
+   Severity: Low
+
+   Issue summary: A malicious remote peer may flood the local QUIC stack
+   with `NEW_CONNECTION_ID` frames by avoiding a limit check on how many
+   connection IDs the remote QUIC stack can use.
+
+   Impact summary: The local QUIC stack sends a `RETIRE_CONN_ID` frame
+   for every `NEW_CONNECTION_ID` frame it receives.  The `RETIRE_CONN_ID`
+   frame is dispatched via the Control Frame Queue (CFQ).  If the remote
+   peer also withholds ACKs, then it can force the local stack to allocate
+   up to ~400 MB (depending on ACK delay).
+
+   Reported by: Bhabani Sankar Das.
+
+   ([CVE-2026-84784])
+
+   *Alexandr Nedvědický*
+
+ * Fixed a bug where `EVP_DecryptFinal()` incorrectly reported a stale success
+   on AES-SIV authentication failure after a preciously successful message
+   decryption.
+   <!-- https://github.com/openssl/openssl/pull/31610 -->
+
+   *Abel Thomas*
+
+ * Fixed a bug in `OSSL_HTTP_get()` that allowed to perform HTTPS-to-HTTP
+   downgrade through a relative redirect.
+   <!-- https://github.com/openssl/openssl/pull/32694 -->
+
+   *Mounir IDRASSI*
+
+ * Changed the OpenSSL FIPS provider so that every algorithm advertised
+   with `fips=yes` property explicitly exposes a `fips-indicator` gettable
+   context parameter, that returns 1 for an approved operation.  The absence
+   of an indicator is no longer interpreted as approval.  Algorithms advertised
+   with `fips=no` property, including X448MLKEM1024, remain unapproved
+   and return 0 when they expose the indicator.
+   <!-- https://github.com/openssl/openssl/pull/32913 -->
+
+   *Shane Lontis*
+
+ * Changed the compiler flags supplied to MSVC targets to no longer include
+   `/Gs0` (resetting the minimum memory size occupied by local variables
+   for including stack probes to the default value of 4096), as it led
+   to mis-compilation of MD4 C implementation on ARM64.
+   <!-- https://github.com/openssl/openssl/pull/32872 -->
+
+   *Norbert Pócs*
+
 ### Changes between 3.5.7 and 3.5.8 [25 Aug 2026]
 
  * Fixed QUIC server being able to trigger double free when processing `INITIAL`
@@ -22521,22 +22811,35 @@ ndif
 [CVE-2026-34181]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34181
 [CVE-2026-34182]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34182
 [CVE-2026-34183]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-34183
+[CVE-2026-35189]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35189
+[CVE-2026-35191]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-35191
 [CVE-2026-42764]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42764
 [CVE-2026-42766]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42766
 [CVE-2026-42767]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42767
 [CVE-2026-42768]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42768
 [CVE-2026-42769]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42769
 [CVE-2026-42770]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42770
+[CVE-2026-42772]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-42772
 [CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
 [CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
 [CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54872]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54872
+[CVE-2026-54873]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54873
 [CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-54875]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54875
 [CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
 [CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
 [CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
 [CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
 [CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-72897]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-72897
 [CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
+[CVE-2026-75804]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75804
+[CVE-2026-75805]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75805
+[CVE-2026-75806]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75806
+[CVE-2026-77696]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-77696
+[CVE-2026-84782]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782
+[CVE-2026-84784]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-84784
 [ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
 [RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
 [RFC 3211]: https://datatracker.ietf.org/doc/html/rfc3211
@@ -22545,3 +22848,4 @@ ndif
 [RFC 8446]: https://datatracker.ietf.org/doc/html/rfc8446
 [RFC 8446 Section 4.6.1]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1
 [RFC 8452]: https://datatracker.ietf.org/doc/html/rfc8452
+[RFC 9000]: https://datatracker.ietf.org/doc/html/rfc9000
@@ -1566,7 +1566,7 @@ my %targets = (
         template         => 1,
         CFLAGS           => add(picker(debug   => '/Od',
                                        release => '/O2')),
-        cflags           => add(picker(default => '/Gs0 /GF /Gy',
+        cflags           => add(picker(default => '/GF /Gy',
                                        debug   =>
                                        sub {
                                            ($disabled{shared} ? "" : "/MDd");