OpenSSL 3.5.9 closes a high-severity hole and a stack of QUIC bugs

OpenSSL published a security advisory on 29 September 2026 and shipped the fixes the same day. Users on 3.5 move to 3.5.9. Users on 3.6 move to 3.6.5. The 4.0 line moves to 4.0.3, and 3.4 moves to 3.4.8. The project says the most severe issue fixed in 3.5.9 is High. Branches 3.1, 3.2, and 3.3 are out of support and were not part of the analysis. If a server is still on one of those, the advisory does not give you a patch. You need a supported line.

The 3.5.9 notes list a long set of fixes, not a single bug. DTLS could retransmit handshake messages from a stale buffer offset (CVE-2026-84782). Relative CRL distribution-point handling could allocate excessive memory (CVE-2026-35189). Several QUIC issues are in the same list: amplification credit that can be over-counted, fragment reassembly that can burn CPU, stream metadata that can be abused for denial of service, connection-level flow control that was not enforced, and an unbounded backlog of RETIRE_CONNECTION_ID. There is also a timing side channel in SM2 signature generation, non-constant-time SM2 scalar multiplication on ARM64 and RISC-V, an out-of-bounds access after SSL_set_SSL_CTX() during a handshake, a NULL dereference in CMP client revocation handling, and an undersized unauthenticated DTLS 1.2 record that can take the process down. EVP_DecryptFinal() could also report success from a stale result when AES-SIV authentication failed.

You do not need to memorize that list to act on it. You need to know which OpenSSL a process actually loads. Node.js 26.11 and the new Python installers both picked up 3.5.9 in their own bundles. A system package update does not change a runtime that ships its own copy, and the other way around is also true. Check both.