LibreSSL 4.4 has been released as the first stable version of the 4.4.x series, introducing security fixes, TLS handling improvements, and expanded platform compatibility. The new release, also included in OpenBSD 8.0, builds on LibreSSL 4.3 with changes affecting certificate validation, cryptographic operations, and the library’s TLS implementation.
One notable change is that LibreSSL now prefers X25519MLKEM768 for TLS 1.3 connections established through libtls. This hybrid key exchange combines traditional elliptic-curve cryptography with ML-KEM, a post-quantum algorithm designed to resist attacks from future quantum computers.
On the security side, LibreSSL 4.4 removes the eMudhra emSign ECC Root CA – G3 certificate from its default certificate bundle after weaknesses were identified in keys used by some subordinate certificate authorities. Uncompromised intermediate certificates have been added to maintain interoperability.
Administrators should note that reinstalling LibreSSL no longer overwrites an existing cert.pem file. Systems may require a manual certificate bundle update if their package manager does not handle the removal automatically.
The release also addresses an OCSP responder authorization bypass affecting clients configured to require certificate stapling. According to the developers, the only known affected applications are OpenBSD’s nc and ftp utilities when used with the muststaple option.
Additional security improvements include fixes for X.509 name constraints validation, where specially crafted URI user information could bypass hostname checks. IPv6 address handling has been corrected. DTLS handshake buffering now has size limits to prevent excessive memory consumption caused by fragmented handshake messages.
TLS reliability receives several fixes as well. These include better handling of TLS 1.3 HelloRetryRequest messages, stricter ALPN negotiation that rejects protocols not advertised by the client, and corrections to TLS 1.2 connections using custom elliptic-curve lists.
On the performance front, SHA-3 operations benefit from an optimized, unrolled and interleaved implementation. LibreSSL improves memory handling by allocating TLS 1.3 receive buffers only when needed, alongside numerous internal cleanups to DTLS and certificate-processing code.
Compatibility improvements extend across several platforms, including support for building on macOS 27, fixes for Windows networking and memory handling, and build corrections for AIX. The release enables additional assembly optimizations on ARM64 and RISC-V systems.
Finally, the update improves regression testing for DTLS and TLS renegotiation, while adjusting the testing framework to rely on memory rather than files.
For more information, see the LibreSSL 4.4.0 release notes.