Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client by abtom87 · Pull Request #31174 · openssl/openssl

abtom87 · 2026-05-13T18:07:11Z

Add validation to reject session ticket lifetime hints exceeding 604800 seconds (7 days) in TLS 1.3 connections, as required by RFC 8446 Section 4.6.1.

TLS 1.3 client validates the lifetime value received from the server.

Fixes#30808

Checklist

documentation is added or updated
tests are added or updated

abtom87 · 2026-05-14T04:47:33Z

Generated a new error code in crypto/err/openssl.txt using this command.
perl util/mkerr.pl -internal -module ssl -rebuild.
@esyr Is that the right way to do it?

mattcaswell · 2026-05-14T07:25:19Z

@esyr Is that the right way to do it?

No. Just insert the new error code into your C file, and then run "make update".

abtom87 · 2026-05-14T07:56:24Z

@esyr Is that the right way to do it?
No. Just insert the new error code into your C file, and then run "make update".

@mattcaswell Ok I saw there is a Generated by util/mkerr.pl DO NOT EDIT in stderr.h. And CI jobs fail too, because it cannot find that error code. Any idea how that needs to be handled?

mattcaswell · 2026-05-14T08:47:40Z

@mattcaswell Ok I saw there is a Generated by util/mkerr.pl DO NOT EDIT in stderr.h. And CI jobs fail too, because it cannot find that error code. Any idea how that needs to be handled?

Like I said. Just add the new reason code to your C file and run "make update". The "make update" will call mkerr.pl and do everything that is required to correctly add the error code.

abtom87 · 2026-05-14T19:25:15Z

@mattcaswell Should the NEWS/CHANGES.md be updated as well? Or is that done later?

mattcaswell · 2026-05-15T07:51:34Z

@mattcaswell Should the NEWS/CHANGES.md be updated as well? Or is that done later?

Probably this doesn't warrant a NEWS entry. But feel free to update CHANGES.md as part of this PR.

mattcaswell · 2026-05-18T07:23:03Z

Ping @openssl/committers for second review

abtom87 · 2026-06-16T09:17:34Z

@esyr @t8m Is there anything more that needs to be done here?

mattcaswell

Still looking for a second committer review

npajkovsky

I have my reservation for entry in CHANGES.md.

esyr

I don't think that dropping connections on session tickets with bogus lifetimes helps anything security-wise, honestly.

esyr · 2026-06-16T11:22:33Z

 *Timo Keller*

+ * Add client-side validation to reject session ticket lifetime hints exceeding
+ 604800 seconds (7 days) in TLS 1.3 connections, as required by RFC 8446


Nit: you can use a link syntax for RFC 8446 by enclosing it in square brackets: [RFC 8446]. The URL itself should be added as part of [1].
[1] #31509

esyr · 2026-06-16T11:23:16Z

+ 604800 seconds (7 days) in TLS 1.3 connections, as required by RFC 8446
+ Section 4.6.1 ("Clients MUST NOT cache tickets for longer than 7 days.").
+
+ When a client has to process a new session ticket `tls_process_new_session_ticket` with a `ticket_lifetime_hint`


An overly long line.

esyr · 2026-06-16T11:24:35Z

 if (SSL_CONNECTION_IS_TLS13(s)) {
 PACKET extpkt;

+ /* Fulfilling RFC8446:4.6.1 requirement: Clients MUST NOT cache


First line of a multi-line comment should be empty (it's not Linux's net/, after all).

esyr · 2026-06-16T11:34:15Z

+ * tickets for longer than 7 days.
+ */
+ if (ticket_lifetime_hint > 604800) {
+ SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_INVALID_TICKET_LIFETIME);


I am not convinced that a bogus ticket lifetime should be treated as a fatal protocol violation; at best, either the ticket with bogus life time can be discarded/ignored, or the lifetime can simply be capped at 7 days, as the RFC suggests ("Clients MUST NOT cache tickets for longer than 7 days, regardless of the ticket_lifetime, and MAY delete tickets earlier based on local policy"). Also, "A server MAY treat a ticket as valid for a shorter period of time than what is stated in the ticket_lifetime" gives servers some room for sending bogus lifetimes.

I agree this is not going to be helpful or useful. Ticket lifetime should simply be capped.

esyr · 2026-06-17T08:03:18Z

Proposing to backport it, as it improves protocol compliance and is not expected to have any significant negative impact.

t8m

OK with backport.

openssl-machine · 2026-06-18T09:00:43Z

This pull request is ready to merge

Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: #30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from #31174)

Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: #30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from #31174) (cherry picked from commit 5a85e41)

t8m · 2026-06-18T12:30:15Z

Merged to all the active branches. Thank you.

Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: #30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from #31174) (cherry picked from commit 5a85e41)

Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: openssl#30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from openssl#31174)

Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: openssl#30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from openssl#31174) (cherry picked from commit 5a85e41)

Add client-side validation to check if session ticket lifetime hints exceeds 7 days in TLS1.3 connections and caps it to the maximum value of 7 days(604800 seconds). Modified `CHANGES.md` with the description of updated change. Resolves: openssl#30808 Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> MergeDate: Thu Jun 18 12:25:33 2026 (Merged from openssl#31174)

4.0.2 CHANGES.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * #31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * #31749 "Add documentation for OPENSSL_armcap" * #31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32300 "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" 4.0.2 NEWS.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32300 "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> 14456 Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:33:50 2026

3.6.4 CHANGES.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * #31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * #31749 "Add documentation for OPENSSL_armcap" * #31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32259 "[3.6] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" 3.6.4 NEWS.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32259 "[3.6] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:35:50 2026

3.5.8 CHANGES.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * #31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * #31749 "Add documentation for OPENSSL_armcap" * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32416 "[3.5,3.4] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" 3.5.8 NEWS.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32416 "[3.5,3.4] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:36:56 2026

3.4.7 CHANGES.md includes the following: * CVE-2026-14457, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * #31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * #32416 "[3.5,3.4] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" 3.4.7 NEWS.md includes the following: * CVE-2026-14457, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #32416 "[3.5,3.4] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:37:42 2026

3.0.22 CHANGES.md includes the following: * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803 * #31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * #31578 "Backport PR #30313 into 3.0 branch." * #32417 "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" 3.0.22 NEWS.md includes the following: * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803 * #32417 "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:38:33 2026

4.0.2 CHANGES.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * openssl#31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * openssl#31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * openssl#31749 "Add documentation for OPENSSL_armcap" * openssl#31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * openssl#32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * openssl#32300 "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * openssl#32427 "Backport openssl#32256 openssl 4.0 to 3.0" 4.0.2 NEWS.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * openssl#31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * openssl#32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * openssl#32300 "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * openssl#32427 "Backport openssl#32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

4.0.2 CHANGES.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * #31572 "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts" * #31749 "Add documentation for OPENSSL_armcap" * #31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32300 "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" 4.0.2 NEWS.md includes the following: * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-75803 * #31764 "x509: fix OCSP BasicResponse leak during verification" (included as CVE-2026-54876) * #32052 "QUIC server: limit the number of pending connections" (included as CVE-2026-14456) * #32300 "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * #32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Andrew Dinh <andrewd@openssl.org> Merge-date: Fri Aug 28 11:16:09 2026 Merged-from: #32484

3.0.22 CHANGES.md includes the following: * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803 * openssl#31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * openssl#31578 "Backport PR openssl#30313 into 3.0 branch." * openssl#32417 "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * openssl#32427 "Backport openssl#32256 openssl 4.0 to 3.0" 3.0.22 NEWS.md includes the following: * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803 * openssl#32417 "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * openssl#32427 "Backport openssl#32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org> Reviewed-by: Milan Broz <mbroz@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.foundation> Reviewed-by: Bob Beck <beck@openssl.org> Merge-date: Tue Aug 25 11:38:33 2026 (cherry picked from commit 2f6e1a9)

abtom87 mentioned this pull request May 13, 2026
TLS 1.3 client does not validate ticket_lifetime <= 604800 per RFC 8446 §4.6.1 #30808
Closed

abtom87 force-pushed the fix-tls1.3-client-ticket-lifetime branch from 5fe4f5a to 889cdc3Compare May 14, 2026 07:56

openssl-machine added the approval: review pending This pull request needs review by a committer label May 14, 2026

esyr force-pushed the fix-tls1.3-client-ticket-lifetime branch from 889cdc3 to 42318fcCompare May 14, 2026 09:42

abtom87 force-pushed the fix-tls1.3-client-ticket-lifetime branch 2 times, most recently from 1d69d49 to bb30147Compare May 15, 2026 11:08

mattcaswell previously approved these changes May 18, 2026
View reviewed changes

mattcaswell added the branch: master Applies to master branch label May 18, 2026

abtom87 dismissed mattcaswell’s stale review via b9c815cJune 16, 2026 09:16

abtom87 force-pushed the fix-tls1.3-client-ticket-lifetime branch from bb30147 to b9c815cCompare June 16, 2026 09:16

mattcaswell previously approved these changes Jun 16, 2026
View reviewed changes

npajkovsky previously approved these changes Jun 16, 2026
View reviewed changes

openssl-machine added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Jun 16, 2026

esyr requested changes Jun 16, 2026
View reviewed changes

esyr added the hold: discussion The community needs to establish a consensus how to move forward with the issue or PR label Jun 16, 2026

abtom87 dismissed stale reviews from npajkovsky and mattcaswell via c94c285June 17, 2026 06:58

abtom87 requested a review from esyr June 17, 2026 06:58

openssl-machine added approval: review pending This pull request needs review by a committer and removed approval: done This pull request has the required number of approvals labels Jun 17, 2026

t8m added the tests: exempted The PR is exempt from requirements for testing label Jun 17, 2026

t8m approved these changes Jun 17, 2026
View reviewed changes

t8m closed this Jun 18, 2026

mrkinc mentioned this pull request Aug 8, 2026
TLS 1.3 ticket lifetime cap is applied after assignment #32244
Closed

Uh oh!

Uh oh!

Conversation

abtom87 commented May 13, 2026

Checklist

Uh oh!

abtom87 commented May 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattcaswell commented May 14, 2026

Uh oh!

abtom87 commented May 14, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattcaswell commented May 14, 2026

Uh oh!

abtom87 commented May 14, 2026

Uh oh!

mattcaswell commented May 15, 2026

Uh oh!

mattcaswell commented May 18, 2026

Uh oh!

abtom87 commented Jun 16, 2026

Uh oh!

mattcaswell left a comment

Choose a reason for hiding this comment

Uh oh!

npajkovsky left a comment

Choose a reason for hiding this comment

Uh oh!

esyr left a comment

Choose a reason for hiding this comment

Uh oh!

esyrJun 16, 2026

Choose a reason for hiding this comment

Uh oh!

esyrJun 16, 2026

Choose a reason for hiding this comment

Uh oh!

esyrJun 16, 2026

Choose a reason for hiding this comment

Uh oh!

esyrJun 16, 2026

Choose a reason for hiding this comment

Uh oh!

simo5Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

esyr commented Jun 17, 2026

Uh oh!

t8m left a comment

Choose a reason for hiding this comment

Uh oh!

openssl-machine commented Jun 18, 2026

Uh oh!

t8m commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

abtom87 commented May 14, 2026•
edited
Loading

abtom87 commented May 14, 2026•
edited
Loading