v5.12.0

What's Changed

• Clear buffered cipher state per record in aead_tls_open by @WillChilds-Klein in #3587
• Deduplicate digest algorithms in PKCS7_dataInit by @spwalgren in #3579
• Reset cached extension state when reusing an X509 or X509_CRL by @WillChilds-Klein in #3584
• Honor restricted PSS min saltlen for AUTO verify by @justsmth in #3470
• Check EVP_PKEY_assign_EC_KEY return by @prasden in #3620
• Add SHA2-224 and establish the SHA-2 variant pattern by @geedo0 in #3449
• Grow BIO_read_asn1's buffer incrementally, not from the claimed length by @WillChilds-Klein in #3583
• Adding RC2 EVP key length signed truncation guard by @spwalgren in #3589
• Implement remaining SHA2 digests by @geedo0 in #3485
• Salt len truncation fix by @spwalgren in #3570
• Reject repeated AES-XTS data unit operations by @nebeid in #3621
• Verify provider-wide algorithm reachability by @geedo0 in #3486
• Fix -Wunused-but-set-global in fork_ube_detect.c by @samuel40791765 in #3645
• Reject failed signature controls (CWE-393) by @justsmth in #3643
• Reserve alignment slack in SSLBuffer max capacity by @samuel40791765 in #3642
• fix(ci): scope id-token permission to report-failures job in integration omnibus by @dougch in #3640
• Fix -Wunused-but-set-global in rand_isolated_test.cc by @justsmth in #3648
• Validate OCSP HTTP request inputs by @prasden in #3639
• Ensure UBE is caught between thread-local state init and uniqueness test by @torben-hansen in #3654
• Bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #3627
• Bump urllib3 from 2.7.0 to 2.8.0 in /tests/ci by @dependabot[bot] in #3606
• Bump rustls from 0.23.40 to 0.23.45 in /tests/ci/lambda by @dependabot[bot] in #3649
• Add FIPS support to the aws-lc-provider by @geedo0 in #3487
• Bump the cargo-ci-lambda group across 1 directory with 3 updates by @dependabot[bot] in #3658
• Bump the pip-ci group across 1 directory with 3 updates by @dependabot[bot] in #3657
• Scope OCSP noCheck exemption to the responder certificate by @WillChilds-Klein in #3576
• fix(ci): running ci in dedicated msys shell by @spwalgren in #3669
• Reject ECH configuration on DTLS connections by @WillChilds-Klein in #3578
• Import s2n-bignum 2026-09-29 by @justsmth in #3661
• fix(ssl): Reject non-ECDHE cipher in handback by @spwalgren in #3653
• Implement aws-lc-provider error queue handling by @geedo0 in #3488
• Use CMake find_package for OpenSSL by @geedo0 in #3662
• Move AArch64 Keccak round constants out of .text by @justsmth in #3674
• tool-openssl: support cipher name as command (e.g. openssl aes-256-cbc) by @PlasmaIntec in #3666
• Make the SSL_SHA256 constant non-overlapping with the rest by @aydinmercan in #3659
• Fix PKCS12 password prompt test isolation on OpenBSD by @justsmth in #3680
• tool-openssl: add openssl rand subcommand by @PlasmaIntec in #3664
• tool-openssl: add password-based key derivation to openssl enc by @PlasmaIntec in #3665
• feat(tool-openssl): add x509 -serial/-addtrust/-trustout by @spwalgren in #3636
• Hold HPKE key and context buffers out of line by @WillChilds-Klein in #3637
• Explicitly block a small set of intermediates by @torben-hansen in #3688
• feat(tool-openssl): support CA signing, revocation, and CRLs in ca by @spwalgren in #3634
• feat(tool-openssl): add ocsp command by @spwalgren in #3635
• Prepare v5.12.0 by @justsmth in #3689

New Contributors

• @PlasmaIntec made their first contribution in #3666
• @aydinmercan made their first contribution in #3659

Full Changelog: v5.11.0...v5.12.0