Next release containing fixed OpenSSL?

[sourcemain]

Hi, I'm running 26.04 from the official ProcessOne Debian package.

This release seems to bundle OpenSSL 3.5.6, which predates the TLS hardening fix in openssl/openssl#30793, and I think fast_tls.so statically links OpenSSL so updating the system won't fix it.

ejabberd master now contains a fixed version, but 26.04 still contains the old one and is the latest release.

Can you confirm whether 26.04 is actually affected? If so, is the next release soon enough that you would recommend waiting for it or attempting to build straight from master instead?

Thanks

[badlop]

Just a side note: there are installers based in git master. Pick any recent build, download the zip on the bottom that contains the installers

https://github.com/processone/ejabberd/actions/workflows/installers.yml

[sourcemain]

Thanks