What you need to know
OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.
Potentially affected
Applications, appliances, containers and embedded devices that bundle or link OpenSSL, including web servers, VPN gateways, camera and recorder firmware, and custom software built from source.
DSE recommendation
DSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line.
OpenSSL’s release policy lists 3.4 support ending 2026-10-22 and 3.6 ending 2026-11-01, keeps 3.5 as an LTS to 2030-04-08 and 4.0 to 2027-05-14, and says 3.0, 1.1.1 and 1.0.2 are no longer supported except through paid extended support.
Source facts
OpenSSL’s release strategy, last modified 07 May 2026, lists version 4.0 as supported until 2027-05-14, 3.6 until 2026-11-01, 3.5 until 2030-04-08 as an LTS, and 3.4 until 2026-10-22. Versions 3.0, 1.1.1 and 1.0.2 are no longer supported, with extended support available to gain access to security fixes for them.
New releases come every six months, in April and October. Starting with 3.5, an LTS release is designated every two years and supported for at least 5 years, with only security fixes committed during its final year, so there will always be two fully supported LTS releases. Non-LTS releases after 3.5 are fully supported for 13 months, and major releases every two years start with 5.0 in October 2027.
From 3.0.0 onward, OpenSSL uses MAJOR.MINOR.PATCH versioning, with API and ABI compatibility guaranteed for the same major version number.
Applicability
Use this for any software you build or operate that includes OpenSSL. Operating system distributions often backport fixes into older OpenSSL packages under their own support policies, so check the distribution’s status before treating a packaged 3.0 as unpatched.
DSE recommendation
DSE recommends identifying every bundled OpenSSL copy by version and moving anything on 3.0, 3.4 or 3.6 to a supported line. Prefer the 3.5 LTS for products that need long stability, rebuild in-house software against a supported release, and ask appliance and camera vendors which OpenSSL version their firmware ships and when they will update it.
Verification
Run a software composition or file scan for OpenSSL libraries and version strings across servers, containers and firmware images, record the result in the asset inventory, and recheck after each vendor firmware release.
Official reference
OpenSSL Library — Release Strategy. Reviewed October 18, 2026.
Review the official source
OpenSSL Library — Release Strategy · Verified October 18, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE