{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "item": { "id": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "slug": "openssl-3-4-3-6-end-of-support-3-5-lts-4-0", "url": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0.md", "json": "https://update.dsesecurity.com/api/v1/posts/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/" }, "title": "OpenSSL 3.4 support ends October 22, 2026 and 3.6 on November 1; 3.0 and 1.1.1 are already unsupported", "summary": "OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.", "format": { "slug": "briefing", "name": "Briefing" }, "priority": { "slug": "important", "name": "Important" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-18T21:00:47+00:00", "modified_at": "2026-10-18T22:22:07+00:00", "reviewed_on": "2026-10-18", "reading_minutes": 2, "word_count": 302, "potentially_affected": "Applications, appliances, containers and embedded devices that bundle or link OpenSSL, including web servers, VPN gateways, camera and recorder firmware, and custom software built from source.", "dse_recommendation": "DSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line.", "primary_source": { "name": "OpenSSL Library — Release Strategy", "url": "https://openssl-library.org/policies/releasestrat/index.html", "published_on": null, "authority": "openssl-library.org" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.

\n

Source facts

\n

OpenSSL’s release strategy, last modified 07 May 2026, lists version 4.0 as supported until 2027-05-14, 3.6 until 2026-11-01, 3.5 until 2030-04-08 as an LTS, and 3.4 until 2026-10-22. Versions 3.0, 1.1.1 and 1.0.2 are no longer supported, with extended support available to gain access to security fixes for them.

\n

New releases come every six months, in April and October. Starting with 3.5, an LTS release is designated every two years and supported for at least 5 years, with only security fixes committed during its final year, so there will always be two fully supported LTS releases. Non-LTS releases after 3.5 are fully supported for 13 months, and major releases every two years start with 5.0 in October 2027.

\n

From 3.0.0 onward, OpenSSL uses MAJOR.MINOR.PATCH versioning, with API and ABI compatibility guaranteed for the same major version number.

\n

Applicability

\n

Use this for any software you build or operate that includes OpenSSL. Operating system distributions often backport fixes into older OpenSSL packages under their own support policies, so check the distribution’s status before treating a packaged 3.0 as unpatched.

\n

DSE recommendation

\n

DSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line. Prefer the 3.5 LTS for products that need long stability, rebuild in-house software against a supported release, and ask appliance and camera vendors which OpenSSL version their firmware ships and when they will update it.

\n

Verification

\n

Run a software composition or file scan for OpenSSL libraries and version strings across servers, containers and firmware images, record the result in the asset inventory, and recheck after each vendor firmware release.

\n

Official reference

\n

OpenSSL Library — Release Strategy. Reviewed October 18, 2026.

", "content_text": "OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.\nSource facts\nOpenSSL’s release strategy, last modified 07 May 2026, lists version 4.0 as supported until 2027-05-14, 3.6 until 2026-11-01, 3.5 until 2030-04-08 as an LTS, and 3.4 until 2026-10-22. Versions 3.0, 1.1.1 and 1.0.2 are no longer supported, with extended support available to gain access to security fixes for them.\nNew releases come every six months, in April and October. Starting with 3.5, an LTS release is designated every two years and supported for at least 5 years, with only security fixes committed during its final year, so there will always be two fully supported LTS releases. Non-LTS releases after 3.5 are fully supported for 13 months, and major releases every two years start with 5.0 in October 2027.\nFrom 3.0.0 onward, OpenSSL uses MAJOR.MINOR.PATCH versioning, with API and ABI compatibility guaranteed for the same major version number.\nApplicability\nUse this for any software you build or operate that includes OpenSSL. Operating system distributions often backport fixes into older OpenSSL packages under their own support policies, so check the distribution’s status before treating a packaged 3.0 as unpatched.\nDSE recommendation\nDSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line. Prefer the 3.5 LTS for products that need long stability, rebuild in-house software against a supported release, and ask appliance and camera vendors which OpenSSL version their firmware ships and when they will update it.\nVerification\nRun a software composition or file scan for OpenSSL libraries and version strings across servers, containers and firmware images, record the result in the asset inventory, and recheck after each vendor firmware release.\nOfficial reference\nOpenSSL Library — Release Strategy. Reviewed October 18, 2026.", "content_markdown": "OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.\n\n## Source facts\n\nOpenSSL’s [release strategy](https://openssl-library.org/policies/releasestrat/index.html), last modified 07 May 2026, lists version 4.0 as supported until 2027-05-14, 3.6 until 2026-11-01, 3.5 until 2030-04-08 as an LTS, and 3.4 until 2026-10-22. Versions 3.0, 1.1.1 and 1.0.2 are no longer supported, with extended support available to gain access to security fixes for them.\n\nNew releases come every six months, in April and October. Starting with 3.5, an LTS release is designated every two years and supported for at least 5 years, with only security fixes committed during its final year, so there will always be two fully supported LTS releases. Non-LTS releases after 3.5 are fully supported for 13 months, and major releases every two years start with 5.0 in October 2027.\n\nFrom 3.0.0 onward, OpenSSL uses MAJOR.MINOR.PATCH versioning, with API and ABI compatibility guaranteed for the same major version number.\n\n## Applicability\n\nUse this for any software you build or operate that includes OpenSSL. Operating system distributions often backport fixes into older OpenSSL packages under their own support policies, so check the distribution’s status before treating a packaged 3.0 as unpatched.\n\n## DSE recommendation\n\nDSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line. Prefer the 3.5 LTS for products that need long stability, rebuild in-house software against a supported release, and ask appliance and camera vendors which OpenSSL version their firmware ships and when they will update it.\n\n## Verification\n\nRun a software composition or file scan for OpenSSL libraries and version strings across servers, containers and firmware images, record the result in the asset inventory, and recheck after each vendor firmware release.\n\n## Official reference\n\n[OpenSSL Library — Release Strategy](https://openssl-library.org/policies/releasestrat/index.html). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "url": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "OpenSSL 3.4 support ends October 22, 2026 and 3.6 on November 1; 3.0 and 1.1.1 are already unsupported", "item": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/#article", "identifier": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "url": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/", "headline": "OpenSSL 3.4 support ends October 22, 2026 and 3.6 on November 1; 3.0 and 1.1.1 are already unsupported", "description": "OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and…", "abstract": "OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.", "articleBody": "OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.\nSource facts\nOpenSSL’s release strategy, last modified 07 May 2026, lists version 4.0 as supported until 2027-05-14, 3.6 until 2026-11-01, 3.5 until 2030-04-08 as an LTS, and 3.4 until 2026-10-22. Versions 3.0, 1.1.1 and 1.0.2 are no longer supported, with extended support available to gain access to security fixes for them.\nNew releases come every six months, in April and October. Starting with 3.5, an LTS release is designated every two years and supported for at least 5 years, with only security fixes committed during its final year, so there will always be two fully supported LTS releases. Non-LTS releases after 3.5 are fully supported for 13 months, and major releases every two years start with 5.0 in October 2027.\nFrom 3.0.0 onward, OpenSSL uses MAJOR.MINOR.PATCH versioning, with API and ABI compatibility guaranteed for the same major version number.\nApplicability\nUse this for any software you build or operate that includes OpenSSL. Operating system distributions often backport fixes into older OpenSSL packages under their own support policies, so check the distribution’s status before treating a packaged 3.0 as unpatched.\nDSE recommendation\nDSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line. Prefer the 3.5 LTS for products that need long stability, rebuild in-house software against a supported release, and ask appliance and camera vendors which OpenSSL version their firmware ships and when they will update it.\nVerification\nRun a software composition or file scan for OpenSSL libraries and version strings across servers, containers and firmware images, record the result in the asset inventory, and recheck after each vendor firmware release.\nOfficial reference\nOpenSSL Library — Release Strategy. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:47+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/openssl-3-4-3-6-end-of-support-3-5-lts-4-0/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "OpenSSL 3.4 support ends October 22, 2026 and 3.6 on November 1; 3.0 and 1.1.1 are already unsupported" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 302, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OpenSSL Library — Release Strategy", "url": "https://openssl-library.org/policies/releasestrat/index.html" } } ] } }