Alpine Linux patches OpenSSL across all four active release branches
Simultaneous security updates for every supported branch shipped on September 17, and nearly all of it comes down to OpenSSL. Here's what changed on each line.
Alpine Linux fixed OpenSSL vulnerabilities across all four of its supported branches, and it did the whole job in a single afternoon. The project shipped 3.21.8, 3.22.6, 3.23.6, and 3.24.2 on September 17. Each release plugs every known high- and medium-severity OpenSSL hole for its line, plus a grab-bag of other security and bug fixes, per the official announcement.
Four commits. Four branches. The whole thing went through co-founder Natanael Copa. A bit of a detail, but it's the tell of a project that juggles several long-lived branches at once and just wants the patches out the door.
"These releases fix all known high and medium severity OpenSSL vulnerabilities applicable to each release branch, along with other security and bug fixes," the project said.
The OpenSSL picture by branch
Three of the four branches are on the newest line. Alpine moved 3.22, 3.23, and 3.24 from OpenSSL 3.5.7-r0 to 3.5.8-r0, picking up 10 new CVEs in the process: CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, and CVE-2026-75803.
The 3.21 branch, on the other hand, still rides the legacy 3.3.x line. It goes from 3.3.7-r0 to 3.3.7-r1 and takes on 13 CVEs: CVE-2026-9076, CVE-2026-34182, CVE-2026-34183, CVE-2026-42766, CVE-2026-42768, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-63072, CVE-2026-63073, CVE-2026-63076, and CVE-2026-75803.
Notice the split. The newer three jump to 3.5.x, while 3.21 stays put instead of taking a major version bump. That's the backporting model doing its thing: as a branch ages, Alpine keeps patching the version it already ships rather than forcing an upgrade. It also means 3.21's OpenSSL is effectively frozen at this version, security fixes only and no later bump. Worth flagging that these counts reflect additions in this single update, not running totals. Keep in mind the same caveat applies to the newer branches.
The 3.21 clock and the 3.24 baseline
The part that actually matters for operators: 3.21.8 is one of the last security updates this branch will see. 3.21 hits end of support on November 1, 2026, roughly six weeks out. After that date, nothing more official for it.
Alpine runs its branches on staggered timelines. The main repository gets about two years of coverage, and the community repo lasts until the next stable release. Right now that spread looks like 3.24 from June 9, 2026 supported through mid-2028 with both repos; 3.23 from December 2025 through November 2027 on main only; 3.22 from May 2025 through May 2027, also main only; and 3.21 from December 2024, closing out November 1, 2026, main repo only.
The newest line, 3.24, has the longest runway by a wide margin. If you're still on 3.21, this is the moment to schedule the migration instead of hoping it waits.
The release cadence has been scattered lately. 3.24.0 landed June 9, 3.24.1 followed four days later, and 3.21.7 sat in a mixed batch back in April. Six months of quiet for OpenSSL work is exactly what makes a simultaneous quadruple update like this stand out.
This patch rides on top of Alpine 3.24.0, the major from June, and that version pulled in a lot of upstream bumps. GRUB 2.14, LLVM 22, Rust 1.96, GNOME 50, Go 1.26, KDE Plasma 6.6, Qt 6.11, Sway 1.12, nginx 1.30.
Alpine has never really been a desktop distro, so seeing GNOME 50 and KDE Plasma 6.6 land in the same breath is at least a shift. The bigger wrinkle is Python: setuptools 82.0.0 removed the deprecated pkg_resources module, so anything still leaning on it needs to migrate. There's also a deprecated qemu-binfmt service, a handful of GTK and Qt5 removals, and libsoup 2 now gone. The installer got a facelift too, adding Limine bootloader support, IPv6, and automatic boot-loader setup for serial consoles — notably smoother for headless boxes.
Alpine says to run apk upgrade --available when switching major versions, and GRUB users must re-run grub-install <device> afterward.
Head here to the official announcement, and check the security database at secdb.alpinelinux.org for per-branch secfixes before you upgrade. The OpenSSL APKBUILD diffs themselves live in the aports repo on GitLab.
