Library
OpenSSL
OpenSSL 3.0, the current long-term-support branch, stops receiving fixes
departs 7 Sept 2026
What this means for you
OpenSSL 3.0 is the LTS branch that shipped with a large share of long-lived Linux distributions and vendor appliances, so this is one of the widest-reaching dates on the calendar. After it passes, no further fixes are published for 3.0 — including security fixes. Anything still linked against it keeps working, and that is the danger: nothing breaks visibly, the patches simply stop arriving.
Where to go
Move to a supported branch — 3.5 is the current LTS. If you consume OpenSSL through your distribution rather than directly, the relevant date is usually your distro's, not this one: distributions with their own long support windows (RHEL, Ubuntu LTS) backport fixes into their 3.0 packages beyond upstream EOL. Check whether your vendor does before assuming you are exposed, and check whether it does not before assuming you are safe.
- OpenSSL 3.5 (LTS)
- Distribution-backported OpenSSL 3.0, where your vendor offers it
OpenSSL publishes support windows on a single release-strategy page, and 3.0 has carried an explicit LTS marker there since it shipped: “supported until 2026-09-07 (LTS)”.
The reason this one deserves attention out of proportion to its size is the indirection. Very few teams install OpenSSL deliberately; they inherit it, through a base image, a package manager, a language runtime, or a piece of hardware. The upstream date is therefore not automatically your date — but it is the date after which no one upstream is looking at 3.0 anymore, and every backport downstream of it becomes someone else’s discretionary effort.
Worth checking now rather than in September: what your container base images actually link against, and whether your appliance vendors have said anything at all.
Entry changelog
- — last reviewed.
- — Entry created from the official release-strategy page.
Spot an error or a changed date? Tell us and it’s corrected the same night.