Azure CLI 2.88.0 installed on Windows contains libssl-3.dll and libcrypto-3.dll version 3.0.20. Security scanning tools flag CVE-2026-34182, which requires OpenSSL 3.0.21 or later. Please confirm the remediation timeline.

[DiwakarKShell]

Describe the bug

Azure CLI 2.88.0 installed on Windows contains libssl-3.dll and libcrypto-3.dll version 3.0.20. Security scanning tools flag CVE-2026-34182, which requires OpenSSL 3.0.21 or later. Please confirm the remediation timeline.

Related command

libssl-3.dll and libcrypto-3.dll version 3.0.20

Errors

None

Issue script & Debug output

(Get-Item "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\libssl-3.dll").VersionInfo.FileVersion

Expected behavior

libssl-3.dll >= 3.0.21
libcrypto-3.dll >= 3.0.21

Environment Summary

PS C:\Windows\system32> az --version
azure-cli 2.88.0

core 2.88.0
telemetry 1.1.0

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\DiwakarK.azure'
Extensions directory 'C:\Users\DiwakarK.azure\cliextensions'

Python (Windows) 3.14.5 (tags/v3.14.5:5607950, May 10 2026, 10:34:21) [MSC v.1944 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.
PS C:\Windows\system32>

Additional context

No response

[DiwakarKShell]

did you just swap the lib files with 3.0.21 versions?

[yonzhan]

OpenSSL version bump

[msarfraz]

OpenSSL version bump requires the embedded python version to be upgraded from 3.14.5 to 3.14.6.
The python patched version will be updated in the upcoming Azure CLI release v2.89.0

[DiwakarKShell]

@msarfraz Thank you for the update. Can you provide tentative date for Azure CLi release v2.89.0?