python · Yhg1s · Sep 27, 2026 · Aug 14, 2025 · Sep 23, 2026 · Sep 23, 2026
@@ -378,7 +378,7 @@ jobs:
     needs: build-context
     if: needs.build-context.outputs.run-ubuntu == 'true'
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -485,7 +485,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04]
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
     steps:

@@ -50,7 +50,7 @@ jobs:
           --with-pydebug \
           ${{ inputs.free-threading && '--disable-gil' || '' }} \
           --prefix=/opt/python-dev \
-          --with-openssl="$(brew --prefix openssl@3.0)"
+          --with-openssl="$(brew --prefix openssl@3.5)"
     - name: Build CPython
       run: make -j8
     - name: Display build info

@@ -25,7 +25,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     env:
-      OPENSSL_VER: 3.0.22
+      OPENSSL_VER: 3.5.8
       PYTHONSTRICTEXTENSIONBUILD: 1
       TERM: linux
     steps:

@@ -221,7 +221,7 @@ def unpack_deps(host, prefix_dir, cache_dir):
     for name_ver in [
         "bzip2-1.0.8-3",
         "libffi-3.4.4-3",
-        "openssl-3.0.22-0",
+        "openssl-3.5.8-0",
         "sqlite-3.53.4-0",
         "xz-5.4.6-1"
     ]:

@@ -73,7 +73,7 @@ download them.
 
     - builds the following third-party libraries
 
-        * OpenSSL 3.0.x
+        * OpenSSL 3.5.x
         * Tcl/Tk 8.6.x
         * NCurses
         * SQLite

@@ -246,9 +246,9 @@ def library_recipes():
 
     result.extend([
           dict(
-              name="OpenSSL 3.0.22",
-              url="https://github.com/openssl/openssl/releases/download/openssl-3.0.22/openssl-3.0.22.tar.gz",
-              checksum="67ebca7e50d17383028045486653492195b83db95f8558709701bb47b5c1ef81",
+              name="OpenSSL 3.5.8",
+              url="https://github.com/openssl/openssl/releases/download/openssl-3.5.8/openssl-3.5.8.tar.gz",
+              checksum="a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2",
               buildrecipe=build_universal_openssl,
               configure=None,
               install=None,

diff --git a/Misc/Brewfile b/Misc/Brewfile
@@ -1,6 +1,6 @@
 brew "gdbm"
 brew "mpdecimal"
-brew "openssl@3.0"
+brew "openssl@3.5"
 brew "pkg-config"
 brew "tcl-tk@8"
 brew "xz"

diff --git a/Misc/NEWS.d/next/Build/2026-08-26-16-10-15.gh-issue-156369.55jGEj.rst b/Misc/NEWS.d/next/Build/2026-08-26-16-10-15.gh-issue-156369.55jGEj.rst
diff --git a/Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst b/Misc/NEWS.d/next/Build/2026-09-23-12-01-50.gh-issue-158010.Hk83NK.rst
@@ -0,0 +1,2 @@
+Updated Android builds to use OpenSSL 3.5.8, jumping from the 3.0 series
+to 3.5 after 3.0's end of public support in September 2026.
diff --git a/Misc/NEWS.d/next/Windows/2026-08-28-10-55-22.gh-issue-156369.ETuGDj.rst b/Misc/NEWS.d/next/Windows/2026-08-28-10-55-22.gh-issue-156369.ETuGDj.rst
diff --git a/Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst b/Misc/NEWS.d/next/Windows/2026-09-23-12-05-40.gh-issue-158010.MPcRL5.rst
@@ -0,0 +1,2 @@
+Updated Windows builds to use OpenSSL 3.5.8, jumping from the 3.0 series
+to 3.5 after 3.0's end of public support in September 2026.
diff --git a/Misc/NEWS.d/next/macOS/2026-08-27-04-35-56.gh-issue-156369.0A8dm_.rst b/Misc/NEWS.d/next/macOS/2026-08-27-04-35-56.gh-issue-156369.0A8dm_.rst
diff --git a/Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst b/Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst
@@ -0,0 +1,2 @@
+Updated macOS installer to use OpenSSL 3.5.8, jumping from the 3.0 series
+to 3.5 after 3.0's end of public support in September 2026.
@@ -70,21 +70,21 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "0a7db2958a5ba7f3a7438835f1a583476a611aa160e04b445f9a25e2ffe865aa"
+          "checksumValue": "36af13403a6f34251c875946d1d524c228cbf7b82fd54dd13d9019fbc37da87e"
         }
       ],
-      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.22.tar.gz",
+      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.5.8.tar.gz",
       "externalRefs": [
         {
           "referenceCategory": "SECURITY",
-          "referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.22:*:*:*:*:*:*:*",
+          "referenceLocator": "cpe:2.3:a:openssl:openssl:3.5.8:*:*:*:*:*:*:*",
           "referenceType": "cpe23Type"
         }
       ],
       "licenseConcluded": "NOASSERTION",
       "name": "openssl",
       "primaryPackagePurpose": "SOURCE",
-      "versionInfo": "3.0.22"
+      "versionInfo": "3.5.8"
     },
     {
       "SPDXID": "SPDXRef-PACKAGE-sqlite",
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Updated Android builds to use OpenSSL 3.5.8, jumping from the 3.0 series
		to 3.5 after 3.0's end of public support in September 2026.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Updated Windows builds to use OpenSSL 3.5.8, jumping from the 3.0 series
		to 3.5 after 3.0's end of public support in September 2026.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Updated macOS installer to use OpenSSL 3.5.8, jumping from the 3.0 series
		to 3.5 after 3.0's end of public support in September 2026.