Bump embedded OpenSSL to 3.5.8 (CVE-2026-14456)

deps/openssl/version.bzl

@@ -1 +1 @@
-OPENSSL_VERSION = "3.5.7"
+OPENSSL_VERSION = "3.5.8"

deps/repos.MODULE.bazel

@@ -107,20 +107,20 @@ http_archive(
     patch_strip = 1,
     # [sts] STAC-24773 B1 fix-up 3: patch 0002 dropped. It cherry-picks an
     # April 2026 upstream fix for OSSL_PARAM_BLD_push_octet_* NULL handling
-    # (openssl issue #30728); openssl-3.5.7 (bumped from 3.5.6 in commit
-    # 1740d83631 / STAC-25035) already incorporates that fix, so re-applying
-    # the patch fails with CONTENT_DOES_NOT_MATCH_TARGET at line 383. Surfaced
+    # (openssl issue #30728); every 3.5.x from 3.5.7 on already incorporates
+    # that fix, so re-applying the patch fails with
+    # CONTENT_DOES_NOT_MATCH_TARGET at line 383. Surfaced
     # by B1 because @rpm//:install is the first openscap-chain Bazel target
     # that transitively pulls @openssl — `//packages/agent/dependencies:install`
     # (the only Bazel target hit by STAC-24773's pre-B1 commits) doesn't.
     patches = [
         "//deps/openssl:0001-Set-the-install-name-to-use-rpath-instead-of-absolut.patch",
     ],
-    sha256 = "a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8",
-    strip_prefix = "openssl-3.5.7",
+    sha256 = "a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2",
+    strip_prefix = "openssl-3.5.8",
     urls = [
-        "https://dd-agent-omnibus.s3.amazonaws.com/bazel/openssl-3.5.7.tar.gz",
-        "https://www.openssl.org/source/openssl-3.5.7.tar.gz",
+        "https://dd-agent-omnibus.s3.amazonaws.com/bazel/openssl-3.5.8.tar.gz",
+        "https://www.openssl.org/source/openssl-3.5.8.tar.gz",
     ],
 )
 

omnibus/config/software/openssl3.rb

@@ -28,10 +28,10 @@
 # STAC-24773 D1 in python3.rb / datadog-agent-dependencies.rb). zlib is now
 # installed inline via @zlib//:install and is no longer an omnibus dependency.
 #
-# Version is kept at 3.5.7 to match deps/openssl/version.bzl (STS is a patch
-# release ahead of upstream base-7.78.2's 3.5.6; bumped in commit 42e0e0b8bf
-# for CVE-2025-9230 / openssl issue #30728).
-default_version "3.5.7"
+# Must match deps/openssl/version.bzl — the Bazel repo rule is what actually
+# builds OpenSSL, and a divergence here silently reports the wrong version.
+# STS runs ahead of upstream base-7.78.2's 3.5.6 to carry CVE fixes.
+default_version "3.5.8"
 
 relative_path "openssl-#{version}"
 

releasenotes/notes/cve-2026-14456-openssl-3-5-8-4f1a9c2d7b3e6058.yaml

@@ -0,0 +1,6 @@
+---
+security:
+  - |
+    Upgrade the embedded OpenSSL to 3.5.8, addressing ``CVE-2026-14456``
+    (unbounded memory growth in the QUIC server incoming channel queue) along
+    with the other CVEs fixed in that release.