@@ -31,86 +31,6 @@ OpenSSL 3.6
 
 ### Changes between 3.5 and 3.6 [xx XXX xxxx]
 
- * Fixed Out-of-bounds read&write in RFC 3211 KEK Unwrap
-
-   Issue summary:  An application trying to decrypt CMS messages encrypted using
-   password-based encryption can trigger an out-of-bounds read and write.
-
-   Impact summary:  This out-of-bounds read may trigger a crash which leads
-   to Denial of Service for an application.  The out-of-bounds write can cause
-   a memory corruption which can have various consequences, including
-   a Denial of Service or Execution of attacker-supplied code.
-
-   The issue was reported by Stanislav Fort (Aisle Research).
-
-   ([CVE-2025-9230])
-
-   *Viktor Dukhovni*
-
- * Fixed Timing side-channel in SM2 algorithm on 64-bit ARM
-
-   Issue summary:  A timing side-channel which could potentially allow remote
-   recovery of the private key exists in the SM2 algorithm implementation
-   on 64-bit ARM platforms.
-
-   Impact summary:  A timing side-channel in SM2 signature computations
-   on 64-bit ARM platforms could allow recovering the private key
-   by an attacker.
-
-   The issue was reported by Stanislav Fort (Aisle Research).
-
-   ([CVE-2025-9231])
-
-   *Stanislav Fort and Tomáš Mráz*
-
- * Fixed Out-of-bounds read in HTTP client `no_proxy` handling
-
-   Issue summary:  An application using the OpenSSL HTTP client API functions
-   may trigger an out-of-bounds read if the `no_proxy` environment variable
-   is set and the host portion of the authority component of the HTTP URL
-   is an IPv6 address.
-
-   Impact summary:  An out-of-bounds read can trigger a crash which leads
-   to Denial of Service for an application.
-
-   The issue was reported by Stanislav Fort (Aisle Research).
-
-   ([CVE-2025-9232])
-
-   *Stanislav Fort*
-
- * Fixed the length of the ASN.1 sequence for the SM3 digests of RSA-encrypted
-   signatures.
-
-   *Xiao Lou Dong Feng*
-
- * Secure memory allocation calls are no longer used for HMAC keys.
-
-   *Dr Paul Dale*
-
- * `openssl req` no longer generates certificates with an empty extension list
-   when SKID/AKID are set to `none` during generation.
-
-   *David Benjamin*
-
- * The man page date is now derived from the release date provided
-   in `VERSION.dat` and not the current date for the released builds.
-
-   *Enji Cooper*
-
  * Added support for `EVP_SKEY` opaque symmetric key objects to the key
    derivation and key exchange provider methods.  Added
    `EVP_KDF_CTX_set_SKEY()`, `EVP_KDF_derive_SKEY()`,
@@ -122,10 +42,6 @@ OpenSSL 3.6
 
    *Dr Paul Dale*
 
- * Added FIPS 140-3 PCT on DH key generation.
-
-   *Nikola Pajkovský*
-
  * Added `i2d_PKCS8PrivateKey(3)` API to complement `i2d_PrivateKey(3)`,
    the former always outputs PKCS#8.
 

@@ -29,17 +29,6 @@ OpenSSL 3.6
 This release incorporates the following potentially significant or incompatible
 changes:
 
-  * Fixed Out-of-bounds read&write in RFC 3211 KEK Unwrap.
-    ([CVE-2025-9230])
-
-  * Fixed Timing side-channel in SM2 algorithm on 64-bit ARM.
-    ([CVE-2025-9231])
-
-  * Fixed Out-of-bounds read in HTTP client `no_proxy` handling.
-    ([CVE-2025-9232])
-
-  * Added FIPS 140-3 PCT on DH key generation.
-
   * Added NIST security categories for PKEY objects.
 
   * Added support for `EVP_SKEY` opaque symmetric key objects to the key