LibreSSL 4.4 arrives as the first stable 4.4.x release, featuring X25519MLKEM768 as the preferred hybrid key exchange for TLS 1.3 via libtls, certificate bundle updates, and fixes for X.509 validation and OCSP authorization bypasses.
New encryption options
The new version prioritizes the hybrid algorithm X25519MLKEM768 for connections made through libtls. It is a combination of traditional encryption and a new post-quantum algorithm, which is designed to withstand attacks from future quantum computers.
Changes to certificates and security
The update removes the eMudhra emSign ECC Root CA – G3 digital certificate from the default certificate set after vulnerabilities were discovered in keys used by some subordinate CAs. Other valid certificates have been added to maintain compatibility.
Additionally, reinstalling LibreSSL no longer automatically overwrites an existing cert.pem file. The new release also addresses a check bypass issue that affected clients that required certificate authentication. The only known applications affected by this issue are the OpenBSD nc and ftp tools when used with the appropriate configuration.
READ ALSO
Popular Arc browser is closing permanently on December 22, 2026
Fixes and performance improvements
The update includes fixes for validating name rules in certificates, correct handling of IPv6 addresses, and limiting memory during login to avoid excessive consumption. Improvements were also made to login message handling, protocol negotiation, and encryption operations.
Compatibility across systems
The new version improves compatibility by offering support for building the application on macOS, networking and memory fixes for Windows, improvements for AIX systems, as well as optimizations on ARM64 and RISC-V architectures.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)