22 files changed, 370 insertions, 37 deletions
diff --git a/doc/build.info b/doc/build.info
index 0279e2390a32..30f519338a3b 100644
--- a/doc/build.info
+++ b/doc/build.info
@@ -679,6 +679,10 @@ DEPEND[html/man3/BIO_set_callback.html]=man3/BIO_set_callback.pod
 GENERATE[html/man3/BIO_set_callback.html]=man3/BIO_set_callback.pod
 DEPEND[man/man3/BIO_set_callback.3]=man3/BIO_set_callback.pod
 GENERATE[man/man3/BIO_set_callback.3]=man3/BIO_set_callback.pod
+DEPEND[html/man3/BIO_set_flags.html]=man3/BIO_set_flags.pod
+GENERATE[html/man3/BIO_set_flags.html]=man3/BIO_set_flags.pod
+DEPEND[man/man3/BIO_set_flags.3]=man3/BIO_set_flags.pod
+GENERATE[man/man3/BIO_set_flags.3]=man3/BIO_set_flags.pod
 DEPEND[html/man3/BIO_should_retry.html]=man3/BIO_should_retry.pod
 GENERATE[html/man3/BIO_should_retry.html]=man3/BIO_should_retry.pod
 DEPEND[man/man3/BIO_should_retry.3]=man3/BIO_should_retry.pod
@@ -779,6 +783,10 @@ DEPEND[html/man3/CMS_EncryptedData_encrypt.html]=man3/CMS_EncryptedData_encrypt.
 GENERATE[html/man3/CMS_EncryptedData_encrypt.html]=man3/CMS_EncryptedData_encrypt.pod
 DEPEND[man/man3/CMS_EncryptedData_encrypt.3]=man3/CMS_EncryptedData_encrypt.pod
 GENERATE[man/man3/CMS_EncryptedData_encrypt.3]=man3/CMS_EncryptedData_encrypt.pod
+DEPEND[html/man3/CMS_EncryptedData_set1_key.html]=man3/CMS_EncryptedData_set1_key.pod
+GENERATE[html/man3/CMS_EncryptedData_set1_key.html]=man3/CMS_EncryptedData_set1_key.pod
+DEPEND[man/man3/CMS_EncryptedData_set1_key.3]=man3/CMS_EncryptedData_set1_key.pod
+GENERATE[man/man3/CMS_EncryptedData_set1_key.3]=man3/CMS_EncryptedData_set1_key.pod
 DEPEND[html/man3/CMS_EnvelopedData_create.html]=man3/CMS_EnvelopedData_create.pod
 GENERATE[html/man3/CMS_EnvelopedData_create.html]=man3/CMS_EnvelopedData_create.pod
 DEPEND[man/man3/CMS_EnvelopedData_create.3]=man3/CMS_EnvelopedData_create.pod
@@ -1091,6 +1099,10 @@ DEPEND[html/man3/EVP_BytesToKey.html]=man3/EVP_BytesToKey.pod
 GENERATE[html/man3/EVP_BytesToKey.html]=man3/EVP_BytesToKey.pod
 DEPEND[man/man3/EVP_BytesToKey.3]=man3/EVP_BytesToKey.pod
 GENERATE[man/man3/EVP_BytesToKey.3]=man3/EVP_BytesToKey.pod
+DEPEND[html/man3/EVP_CIPHER_CTX_get_app_data.html]=man3/EVP_CIPHER_CTX_get_app_data.pod
+GENERATE[html/man3/EVP_CIPHER_CTX_get_app_data.html]=man3/EVP_CIPHER_CTX_get_app_data.pod
+DEPEND[man/man3/EVP_CIPHER_CTX_get_app_data.3]=man3/EVP_CIPHER_CTX_get_app_data.pod
+GENERATE[man/man3/EVP_CIPHER_CTX_get_app_data.3]=man3/EVP_CIPHER_CTX_get_app_data.pod
 DEPEND[html/man3/EVP_CIPHER_CTX_get_cipher_data.html]=man3/EVP_CIPHER_CTX_get_cipher_data.pod
 GENERATE[html/man3/EVP_CIPHER_CTX_get_cipher_data.html]=man3/EVP_CIPHER_CTX_get_cipher_data.pod
 DEPEND[man/man3/EVP_CIPHER_CTX_get_cipher_data.3]=man3/EVP_CIPHER_CTX_get_cipher_data.pod
@@ -2953,6 +2965,7 @@ html/man3/BIO_s_mem.html \
 html/man3/BIO_s_null.html \
 html/man3/BIO_s_socket.html \
 html/man3/BIO_set_callback.html \
+html/man3/BIO_set_flags.html \
 html/man3/BIO_should_retry.html \
 html/man3/BIO_socket_wait.html \
 html/man3/BN_BLINDING_new.html \
@@ -2978,6 +2991,7 @@ html/man3/BN_zero.html \
 html/man3/BUF_MEM_new.html \
 html/man3/CMS_EncryptedData_decrypt.html \
 html/man3/CMS_EncryptedData_encrypt.html \
+html/man3/CMS_EncryptedData_set1_key.html \
 html/man3/CMS_EnvelopedData_create.html \
 html/man3/CMS_add0_cert.html \
 html/man3/CMS_add1_recipient_cert.html \
@@ -3056,6 +3070,7 @@ html/man3/ERR_remove_state.html \
 html/man3/ERR_set_mark.html \
 html/man3/EVP_ASYM_CIPHER_free.html \
 html/man3/EVP_BytesToKey.html \
+html/man3/EVP_CIPHER_CTX_get_app_data.html \
 html/man3/EVP_CIPHER_CTX_get_cipher_data.html \
 html/man3/EVP_CIPHER_CTX_get_original_iv.html \
 html/man3/EVP_CIPHER_meth_new.html \
@@ -3561,6 +3576,7 @@ man/man3/BIO_s_mem.3 \
 man/man3/BIO_s_null.3 \
 man/man3/BIO_s_socket.3 \
 man/man3/BIO_set_callback.3 \
+man/man3/BIO_set_flags.3 \
 man/man3/BIO_should_retry.3 \
 man/man3/BIO_socket_wait.3 \
 man/man3/BN_BLINDING_new.3 \
@@ -3586,6 +3602,7 @@ man/man3/BN_zero.3 \
 man/man3/BUF_MEM_new.3 \
 man/man3/CMS_EncryptedData_decrypt.3 \
 man/man3/CMS_EncryptedData_encrypt.3 \
+man/man3/CMS_EncryptedData_set1_key.3 \
 man/man3/CMS_EnvelopedData_create.3 \
 man/man3/CMS_add0_cert.3 \
 man/man3/CMS_add1_recipient_cert.3 \
@@ -3664,6 +3681,7 @@ man/man3/ERR_remove_state.3 \
 man/man3/ERR_set_mark.3 \
 man/man3/EVP_ASYM_CIPHER_free.3 \
 man/man3/EVP_BytesToKey.3 \
+man/man3/EVP_CIPHER_CTX_get_app_data.3 \
 man/man3/EVP_CIPHER_CTX_get_cipher_data.3 \
 man/man3/EVP_CIPHER_CTX_get_original_iv.3 \
 man/man3/EVP_CIPHER_meth_new.3 \
diff --git a/doc/man1/openssl-cmp.pod.in b/doc/man1/openssl-cmp.pod.in
index 889a59cd497e..d92e5f2a37cc 100644
--- a/doc/man1/openssl-cmp.pod.in
+++ b/doc/man1/openssl-cmp.pod.in
@@ -1086,7 +1086,7 @@ So far this has no effect because the server does not accept any error messages.
 
 =item B<-accept_raverified>
 
-Accept RAVERIFED as proof of possession (POPO).
+Accept RAVERIFIED as proof of possession (POPO).
 
 =back
 
diff --git a/doc/man1/openssl-cms.pod.in b/doc/man1/openssl-cms.pod.in
index f4d12312b7cb..599c93ee6d30 100644
--- a/doc/man1/openssl-cms.pod.in
+++ b/doc/man1/openssl-cms.pod.in
@@ -410,7 +410,7 @@ Currently the AES variants with GCM mode are the only supported AEAD
 algorithms.
 
 If not specified triple DES is used. Only used with B<-encrypt> and
-B<-EncryptedData_create> commands.
+B<-EncryptedData_encrypt> commands.
 
 =item B<-wrap> I<cipher>
 
@@ -437,7 +437,7 @@ with caution: see the notes section below.
 =item B<-md> I<digest>
 
 Digest algorithm to use when signing or resigning. If not present then the
-default digest algorithm for the signing key will be used (usually SHA1).
+default digest algorithm for the signing key will be used (usually SHA-256).
 
 =item B<-signer> I<file>
 
@@ -764,7 +764,7 @@ The use of PSS with B<-sign>.
 
 The use of OAEP or non-RSA keys with B<-encrypt>.
 
-Additionally the B<-EncryptedData_create> and B<-data_create> type cannot
+Additionally the B<-EncryptedData_encrypt> and B<-data_create> type cannot
 be processed by the older L<openssl-smime(1)> command.
 
 =head1 EXAMPLES
@@ -907,7 +907,7 @@ The B<-engine> option was deprecated in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2008-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man1/openssl-verification-options.pod b/doc/man1/openssl-verification-options.pod
index 17fcd4eb79f5..68aa4402efcc 100644
--- a/doc/man1/openssl-verification-options.pod
+++ b/doc/man1/openssl-verification-options.pod
@@ -581,7 +581,7 @@ keyCertSign bit set if the keyUsage extension is present.
 
 The extKeyUsage (EKU) extension places additional restrictions on
 certificate use. If this extension is present (whether critical or not)
-in an end-entity certficiate, the key is allowed only for the uses specified,
+in an end-entity certificate, the key is allowed only for the uses specified,
 while the special EKU B<anyExtendedKeyUsage> allows for all uses.
 
 Note that according to RFC 5280 section 4.2.1.12,
@@ -639,7 +639,7 @@ This is used as a workaround if the basicConstraints extension is absent.
 =item B<Netscape SSL Server> (C<nssslserver>)
 
 In addition to what has been described for B<sslserver>, for a Netscape
-SSL client to connect to an SSL server, its EE certficate must have the
+SSL client to connect to an SSL server, its EE certificate must have the
 B<keyEncipherment> bit set if the keyUsage extension is present. This isn't
 always valid because some cipher suites use the key for digital signing.
 Otherwise it is the same as a normal SSL server.
@@ -660,19 +660,19 @@ This is used as a workaround if the basicConstraints extension is absent.
 
 =item B<S/MIME Signing> (C<smimesign>)
 
-In addition to the common S/MIME checks, for target certficiates
+In addition to the common S/MIME checks, for target certificates
 the key usage must allow for C<digitalSignature> and/or B<nonRepudiation>.
 
 =item B<S/MIME Encryption> (C<smimeencrypt>)
 
-In addition to the common S/MIME checks, for target certficiates
+In addition to the common S/MIME checks, for target certificates
 the key usage must allow for C<keyEncipherment>.
 
 =item B<CRL Signing> (C<crlsign>)
 
 For target certificates, the key usage must allow for C<cRLSign>.
 
-For all other certifcates the normal CA checks apply.
+For all other certificates the normal CA checks apply.
 Except in this case the basicConstraints extension must be present.
 
 =item B<OCSP Helper> (C<ocsphelper>)
@@ -680,7 +680,7 @@ Except in this case the basicConstraints extension must be present.
 For target certificates, no checks are performed at this stage,
 but special checks apply; see L<OCSP_basic_verify(3)>.
 
-For all other certifcates the normal CA checks apply.
+For all other certificates the normal CA checks apply.
 
 =item B<Timestamp Signing> (C<timestampsign>)
 
@@ -689,7 +689,7 @@ C<digitalSignature> and/or C<nonRepudiation> and must not include other bits.
 The EKU extension must be present and contain C<timeStamping> only.
 Moreover, it must be marked as critical.
 
-For all other certifcates the normal CA checks apply.
+For all other certificates the normal CA checks apply.
 
 =back
 
@@ -722,7 +722,7 @@ The checks enabled by B<-x509_strict> have been extended in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man3/BIO_set_flags.pod b/doc/man3/BIO_set_flags.pod
new file mode 100644
index 000000000000..7899cc3e5751
--- /dev/null
+++ b/doc/man3/BIO_set_flags.pod
@@ -0,0 +1,194 @@
+=pod
+
+=head1 NAME
+
+BIO_set_flags, BIO_clear_flags, BIO_test_flags, BIO_get_flags,
+BIO_set_retry_read, BIO_set_retry_write, BIO_set_retry_special,
+BIO_clear_retry_flags, BIO_get_retry_flags
+- manipulate and interpret BIO flags
+
+=head1 SYNOPSIS
+
+ #include <openssl/bio.h>
+
+ void BIO_set_flags(BIO *b, int flags);
+ void BIO_clear_flags(BIO *b, int flags);
+ int  BIO_test_flags(const BIO *b, int flags);
+ int  BIO_get_flags(const BIO *b);
+
+ void BIO_set_retry_read(BIO *b);
+ void BIO_set_retry_write(BIO *b);
+ void BIO_set_retry_special(BIO *b);
+ void BIO_clear_retry_flags(BIO *b);
+ int  BIO_get_retry_flags(BIO *b);
+
+=head1 DESCRIPTION
+
+A B<BIO> has an internal set of bit flags that describe its state.  These
+functions and macros are used primarily by B<BIO> implementations and by code
+that builds B<BIO> chains to manipulate those flags.
+
+BIO_set_flags() sets the bits given in I<flags> in the B<BIO> I<b>.  Any bits
+already set in the B<BIO>'s flag word remain set.
+
+BIO_clear_flags() clears the bits given in I<flags> from the B<BIO> I<b>.  Any
+other bits in the flag word are left unchanged.
+
+BIO_test_flags() tests the bits given in I<flags> in the B<BIO> I<b> and
+returns a nonzero value if any of them are currently set and zero
+otherwise.
+
+BIO_get_flags() returns the current flag word from the B<BIO> I<b>.  This is
+equivalent to testing for all bits and returning the result.
+
+The following convenience macros are built on top of these primitives and are
+used to maintain the retry state of a BIO:
+
+BIO_set_retry_read() marks the B<BIO> I<b> as being in a retryable state
+by setting the B<BIO_FLAGS_SHOULD_RETRY> flag. In addition, it sets the
+B<BIO_FLAGS_READ> flag to indicate that the retry condition is
+associated with a read operation.
+
+BIO_set_retry_write() marks the B<BIO> I<b> as being in a retryable state
+by setting the B<BIO_FLAGS_SHOULD_RETRY> flag. In addition, it sets the
+B<BIO_FLAGS_WRITE> flag to indicate that the retry condition is
+associated with a write operation.
+
+BIO_set_retry_special() marks the B<BIO> I<b> as being in a retryable state
+by setting the B<BIO_FLAGS_SHOULD_RETRY> flag. In addition, it sets the
+B<BIO_FLAGS_IO_SPECIAL> flag to indicate that the retry condition is
+associated with a read operation some "special" condition.
+The precise meaning of this condition depends on the B<BIO> type.
+
+BIO_clear_retry_flags() clears all retry-related bits from I<b>, i.e.
+B<BIO_FLAGS_READ>, B<BIO_FLAGS_WRITE>, B<BIO_FLAGS_IO_SPECIAL>, and
+B<BIO_FLAGS_SHOULD_RETRY>.
+
+BIO_get_retry_flags() returns retry-related bits that are
+currently set in I<b>.  The result is a subset of
+B<BIO_FLAGS_RWS|BIO_FLAGS_SHOULD_RETRY>.
+
+The retry bits are interpreted by the higher level macros
+BIO_should_read(), BIO_should_write(), BIO_should_io_special(),
+BIO_retry_type() and BIO_should_retry(), as documented in
+L<BIO_should_retry(3)>.  Application code will typically use those macros
+rather than manipulate the underlying flags directly.
+
+The following flag bits are currently defined for use with BIO_set_flags(),
+BIO_clear_flags() and BIO_test_flags():
+
+=over 4
+
+=item B<BIO_FLAGS_READ>
+
+The last I/O operation should be retried when the B<BIO> becomes readable.
+This flag is normally set by the B<BIO> implementation via BIO_set_retry_read()
+after a failed read operation.
+
+=item B<BIO_FLAGS_WRITE>
+
+The last I/O operation should be retried when the B<BIO> becomes writable.
+This flag is normally set by the B<BIO> implementation via BIO_set_retry_write()
+after a failed write operation.
+
+=item B<BIO_FLAGS_IO_SPECIAL>
+
+The last I/O operation should be retried when some "special" condition
+becomes true.  The precise meaning of this condition depends on the B<BIO>
+type and is usually obtained via BIO_get_retry_BIO() and
+BIO_get_retry_reason() as described in L<BIO_should_retry(3)>.
+This flag is normally set by the B<BIO> implementation via
+BIO_set_retry_special().
+
+=item B<BIO_FLAGS_RWS>
+
+The bitwise OR of B<BIO_FLAGS_READ>, B<BIO_FLAGS_WRITE> and
+B<BIO_FLAGS_IO_SPECIAL>.  This mask is used when clearing or extracting
+the retry-direction bits.
+
+=item B<BIO_FLAGS_SHOULD_RETRY>
+
+Set if the last I/O operation on the B<BIO> should be retried at a later time.
+If this bit is not set then the condition is treated as an error.
+This flag is normally set by the B<BIO> implementation.
+
+=item B<BIO_FLAGS_BASE64_NO_NL>
+
+When set on a base64 filter B<BIO> this flag disables the generation of
+newline characters in the encoded output and causes newlines to be ignored
+in the input.  See also L<BIO_f_base64(3)>.
+The flag has no effect on any other built-in B<BIO> types.
+
+=item B<BIO_FLAGS_MEM_RDONLY>
+
+When set on a memory B<BIO> this flag indicates that the underlying buffer is
+read only.  Attempts to write to such a B<BIO> will fail.
+The flag has no effect on any other built-in B<BIO> types.
+
+=item B<BIO_FLAGS_NONCLEAR_RST>
+
+On a memory B<BIO> this flag modifies the behaviour of BIO_reset().  When it
+is set, resetting the B<BIO> does not clear the underlying buffer but only
+resets the current read position.
+The flag has no effect on any other built-in B<BIO> types.
+
+=item B<BIO_FLAGS_IN_EOF>
+
+This flag may be used by a B<BIO> implementation to indicate that the end
+of the input stream has been reached.  However, B<BIO> types are not
+required to use this flag to signal end-of-file conditions; they may rely
+on other mechanisms such as system calls or by querying the next B<BIO> in a
+chain.  Applications must therefore not test this flag directly to
+determine whether EOF has been reached, and must use BIO_eof() instead.
+
+=back
+
+A range of additional flag values is reserved for internal use by OpenSSL
+to track kernel TLS (KTLS) state.  This range and the corresponding flag
+macros are not part of the public API and must not be used by applications.
+
+=head1 RETURN VALUES
+
+BIO_get_flags() returns a bit mask of the flags currently set on the B<BIO>.
+
+BIO_test_flags() returns a bit mask consisting of those flags from the
+argument that are currently set in the B<BIO>. Consequently, it returns a
+nonzero value if and only if at least one of the requested flags is set.
+
+BIO_get_retry_flags() returns a bit mask consisting of those flags from
+B<BIO_FLAGS_READ>, B<BIO_FLAGS_WRITE>, B<BIO_FLAGS_IO_SPECIAL>, and
+B<BIO_FLAGS_SHOULD_RETRY> that are currently set in the I<BIO>.
+
+=head1 NOTES
+
+Ordinary application code will rarely need to call BIO_set_flags(),
+BIO_clear_flags() or BIO_test_flags() directly.  They are intended for B<BIO>
+implementations and for code that forwards retry state from one B<BIO> in a
+chain to another.
+After a failed I/O operation, applications should normally use
+BIO_should_retry() and related macros as described in
+L<BIO_should_retry(3)> instead of inspecting the flags directly.
+
+These functions and macros are not thread-safe. If a single B<BIO>
+is accessed from multiple threads, the caller must provide appropriate
+external synchronisation.
+
+=head1 SEE ALSO
+
+L<BIO_should_retry(3)>, L<BIO_f_base64(3)>, L<bio(7)>
+
+=head1 HISTORY
+
+The functions and macros described here have been available in OpenSSL since
+at least 1.1.0 (B<BIO_FLAGS_IN_EOF> since 1.1.1).
+
+=head1 COPYRIGHT
+
+Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man3/CMS_EncryptedData_decrypt.pod b/doc/man3/CMS_EncryptedData_decrypt.pod
index 3aa3f474fc5a..e890e7c8f5ee 100644
--- a/doc/man3/CMS_EncryptedData_decrypt.pod
+++ b/doc/man3/CMS_EncryptedData_decrypt.pod
@@ -16,10 +16,10 @@ CMS_EncryptedData_decrypt
 =head1 DESCRIPTION
 
 CMS_EncryptedData_decrypt() decrypts a I<cms> EncryptedData object using the
-symmetric I<key> of size I<keylen> bytes. I<out> is a BIO to write the content
-to and I<flags> is an optional set of flags.
-I<dcont> is used in the rare case where the encrypted content is detached. It
-will normally be set to NULL.
+symmetric I<key> of size I<keylen> bytes. AEAD cipher algorithms are not
+supported. I<out> is a BIO to write the content to and I<flags> is an optional
+set of flags. I<dcont> is used in the rare case where the encrypted content is
+detached. It will normally be set to NULL.
 
 The following flags can be passed in the I<flags> parameter.
 
diff --git a/doc/man3/CMS_EncryptedData_encrypt.pod b/doc/man3/CMS_EncryptedData_encrypt.pod
index d3c3b254be03..5f19edcf9a92 100644
--- a/doc/man3/CMS_EncryptedData_encrypt.pod
+++ b/doc/man3/CMS_EncryptedData_encrypt.pod
@@ -34,7 +34,7 @@ B<CMS_PARTIAL>. Internally CMS_final() is called unless B<CMS_STREAM> and/or
 B<CMS_PARTIAL> is specified.
 
 The algorithm passed in the I<cipher> parameter must support ASN1 encoding of
-its parameters.
+its parameters. AEAD cipher algorithms are not supported.
 
 The B<CMS_ContentInfo> structure can be freed using L<CMS_ContentInfo_free(3)>.
 
diff --git a/doc/man3/CMS_EncryptedData_set1_key.pod b/doc/man3/CMS_EncryptedData_set1_key.pod
new file mode 100644
index 000000000000..0722ef18d2f9
--- /dev/null
+++ b/doc/man3/CMS_EncryptedData_set1_key.pod
@@ -0,0 +1,39 @@
+=pod
+
+=head1 NAME
+
+CMS_EncryptedData_set1_key - Sets the cipher and key for
+CMS EncryptedData
+
+=head1 SYNOPSIS
+
+ #include <openssl/cms.h>
+
+ int CMS_EncryptedData_set1_key(CMS_ContentInfo *cms, const EVP_CIPHER *ciph,
+                                const unsigned char *key, size_t keylen);
+
+=head1 DESCRIPTION
+
+CMS_EncryptedData_set1_key() takes in a I<cms> EncryptedData object and sets
+the appropriate attributes to I<ciph>, it makes a copy of the symmetric I<key>
+of size I<keylen>. AEAD cipher algorithms are not supported.
+
+=head1 RETURN VALUES
+
+CMS_EncryptedData_set1_key() returns 0 if an error occurred otherwise
+returns 1.
+
+=head1 SEE ALSO
+
+L<CMS_EncryptedData_encrypt(3)>, L<CMS_EncryptedData_decrypt(3)>
+
+=head1 COPYRIGHT
+
+Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man3/EVP_CIPHER_CTX_get_app_data.pod b/doc/man3/EVP_CIPHER_CTX_get_app_data.pod
new file mode 100644
index 000000000000..3865bb439086
--- /dev/null
+++ b/doc/man3/EVP_CIPHER_CTX_get_app_data.pod
@@ -0,0 +1,38 @@
+=pod
+
+=head1 NAME
+
+EVP_CIPHER_CTX_get_app_data, EVP_CIPHER_CTX_set_app_data - Routines to
+inspect and modify application data related to EVP_CIPHER_CTX
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ void *EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx);
+ void EVP_CIPHER_CTX_set_app_data(EVP_CIPHER_CTX *ctx, void *data);
+
+=head1 DESCRIPTION
+
+The functions EVP_CIPHER_CTX_set_app_data() and EVP_CIPHER_CTX_get_app_data()
+associate an opaque, application-defined pointer with an EVP_CIPHER_CTX object.
+
+This pointer is not interpreted by the library and is reserved entirely for use
+by the application. It may be used to store arbitrary context or state that
+needs to be accessible wherever the corresponding EVP_CIPHER_CTX is available.
+
+=head1 RETURN VALUES
+
+The EVP_CIPHER_CTX_get_app_data() function returns a opaque pointer to the
+current application data for the EVP_CIPHER_CTX.
+
+=head1 COPYRIGHT
+
+Copyright 2026 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod
index 497e6cfe26da..a7e0b453b6db 100644
--- a/doc/man3/EVP_EncryptInit.pod
+++ b/doc/man3/EVP_EncryptInit.pod
@@ -61,8 +61,6 @@ EVP_CIPHER_CTX_get_block_size,
 EVP_CIPHER_CTX_get_key_length,
 EVP_CIPHER_CTX_get_iv_length,
 EVP_CIPHER_CTX_get_tag_length,
-EVP_CIPHER_CTX_get_app_data,
-EVP_CIPHER_CTX_set_app_data,
 EVP_CIPHER_CTX_flags,
 EVP_CIPHER_CTX_set_flags,
 EVP_CIPHER_CTX_clear_flags,
@@ -196,8 +194,6 @@ EVP_CIPHER_CTX_mode
  int EVP_CIPHER_CTX_get_key_length(const EVP_CIPHER_CTX *ctx);
  int EVP_CIPHER_CTX_get_iv_length(const EVP_CIPHER_CTX *ctx);
  int EVP_CIPHER_CTX_get_tag_length(const EVP_CIPHER_CTX *ctx);
- void *EVP_CIPHER_CTX_get_app_data(const EVP_CIPHER_CTX *ctx);
- void EVP_CIPHER_CTX_set_app_data(const EVP_CIPHER_CTX *ctx, void *data);
  int EVP_CIPHER_CTX_get_type(const EVP_CIPHER_CTX *ctx);
  int EVP_CIPHER_CTX_get_mode(const EVP_CIPHER_CTX *ctx);
  int EVP_CIPHER_CTX_get_num(const EVP_CIPHER_CTX *ctx);
@@ -1746,7 +1742,7 @@ The EVP_CIPHER_CTX_flags() macro was deprecated in OpenSSL 1.1.0.
 
 =head1 COPYRIGHT
 
-Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man3/EVP_PKEY_keygen.pod b/doc/man3/EVP_PKEY_keygen.pod
index 433123618606..cc6d174180d8 100644
--- a/doc/man3/EVP_PKEY_keygen.pod
+++ b/doc/man3/EVP_PKEY_keygen.pod
@@ -86,10 +86,12 @@ If the callback returns 0 then the key generation operation is aborted and an
 error occurs. This might occur during a time consuming operation where
 a user clicks on a "cancel" button.
 
-The functions EVP_PKEY_CTX_set_app_data() and EVP_PKEY_CTX_get_app_data() set
-and retrieve an opaque pointer. This can be used to set some application
-defined value which can be retrieved in the callback: for example a handle
-which is used to update a "progress dialog".
+The functions EVP_PKEY_CTX_set_app_data() and EVP_PKEY_CTX_get_app_data()
+associate an opaque, application-defined pointer with an EVP_PKEY_CTX object.
+
+This pointer is not interpreted by the library and is reserved entirely for use
+by the application. It may be used to store arbitrary context or state that
+needs to be accessible wherever the corresponding EVP_PKEY_CTX is available.
 
 EVP_PKEY_Q_keygen() abstracts from the explicit use of B<EVP_PKEY_CTX> while
 providing a 'quick' but limited way of generating a new asymmetric key pair.
@@ -226,7 +228,7 @@ EVP_PKEY_Q_keygen() and EVP_PKEY_generate() were added in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2006-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2006-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man3/OPENSSL_malloc.pod b/doc/man3/OPENSSL_malloc.pod
index 20441e76ac65..70f3cff1e049 100644
--- a/doc/man3/OPENSSL_malloc.pod
+++ b/doc/man3/OPENSSL_malloc.pod
@@ -103,6 +103,10 @@ before ultimately calling OPENSSL_free(). If the argument to OPENSSL_free() is
 NULL, nothing is done.
 
 OPENSSL_cleanse() fills B<ptr> of size B<len> with a string of 0's.
+It is useful in cases when it is needed to ensure that memory (that contains
+sensitive information) is overwritten (for example, before it is reclaimed,
+or when it is stored on stack), and such operation is not optimised out
+by compiler optimisations such as dead store elimination (as memset(3) may be).
 Use OPENSSL_cleanse() with care if the memory is a mapping of a file.
 If the storage controller uses write compression, then it's possible
 that sensitive tail bytes will survive zeroization because the block of
diff --git a/doc/man3/OSSL_DECODER_CTX.pod b/doc/man3/OSSL_DECODER_CTX.pod
index bace3ee0cfed..a98c0e3c4b90 100644
--- a/doc/man3/OSSL_DECODER_CTX.pod
+++ b/doc/man3/OSSL_DECODER_CTX.pod
@@ -167,6 +167,13 @@ I<reference>, unpacks the object which it refers to, and exports it by
 creating an L<OSSL_PARAM(3)> array that it then passes to I<export_cb>,
 along with I<export_arg>.
 
+Note that functions OSSL_DECODER_CTX_set_selection(),
+OSSL_DECODER_CTX_set_output_type(), OSSL_DECODER_CTX_set_output_structure(),
+OSSL_DECODER_CTX_add_encoder(), OSSL_DECODER_CTX_add_extra(),
+OSSL_DECODER_CTX_set_construct(), OSSL_DECODER_CTX_set_construct_data(), and
+OSSL_DECODER_CTX_set_cleanup() shouldn't be used after the context is finalised,
+in particular after calling the function OSSL_DECODER_CTX_new_for_pkey().
+
 =head2 Constructor
 
 A B<OSSL_DECODER_CONSTRUCT> gets the following arguments:
diff --git a/doc/man3/OSSL_DECODER_CTX_new_for_pkey.pod b/doc/man3/OSSL_DECODER_CTX_new_for_pkey.pod
index e55212ad554b..9539f21ccf92 100644
--- a/doc/man3/OSSL_DECODER_CTX_new_for_pkey.pod
+++ b/doc/man3/OSSL_DECODER_CTX_new_for_pkey.pod
@@ -71,6 +71,10 @@ zero).  This helps the caller to distinguish between an error when creating
 the B<OSSL_ENCODER_CTX> and missing encoder implementation, and allows it to
 act accordingly.
 
+Note that OSSL_DECODER_CTX_new_for_pkey() finalises the OSSL_DECODER_CTX;
+after that the OSSL_DECODER_CTX_set_* and OSSL_DECODER_CTX_add_* functions
+described in L<OSSL_DECODER_CTX(3)> shouldn't be called.
+
 OSSL_DECODER_CTX_set_passphrase() gives the implementation a pass phrase to
 use when decrypting the encoded private key. Alternatively, a pass phrase
 callback may be specified with the following functions.
diff --git a/doc/man3/OSSL_ENCODER_CTX.pod b/doc/man3/OSSL_ENCODER_CTX.pod
index e9248c356a05..ab1bfa9c0c35 100644
--- a/doc/man3/OSSL_ENCODER_CTX.pod
+++ b/doc/man3/OSSL_ENCODER_CTX.pod
@@ -130,6 +130,13 @@ passed to the constructor every time it's called.
 OSSL_ENCODER_CTX_set_cleanup() sets the constructor data I<cleanup>
 function.  This is called by L<OSSL_ENCODER_CTX_free(3)>.
 
+Note that functions OSSL_ENCODER_CTX_set_selection(),
+OSSL_ENCODER_CTX_set_output_type(), OSSL_ENCODER_CTX_set_output_structure(),
+OSSL_ENCODER_CTX_add_encoder(), OSSL_ENCODER_CTX_add_extra(),
+OSSL_ENCODER_CTX_set_construct(), OSSL_ENCODER_CTX_set_construct_data(), and
+OSSL_ENCODER_CTX_set_cleanup() shouldn't be used after the context is finalised,
+in particular after calling the function OSSL_ENCODER_CTX_new_for_pkey().
+
 =head2 Constructor
 
 A B<OSSL_ENCODER_CONSTRUCT> gets the following arguments:
@@ -202,6 +209,12 @@ output type.
 OSSL_ENCODER_INSTANCE_get_output_structure() returns a string with the name
 of the output structure.
 
+=head1 NOTES AND BUGS
+
+The chain mechanism in ENCODE is not yet completely implemented.
+It affects functions such as OSSL_ENCODER_CTX_add_extra and the
+inner processing loop.
+
 =head1 SEE ALSO
 
 L<provider(7)>, L<OSSL_ENCODER(3)>
diff --git a/doc/man3/OSSL_ENCODER_CTX_new_for_pkey.pod b/doc/man3/OSSL_ENCODER_CTX_new_for_pkey.pod
index 8ba3bdd46718..58cb376b27c2 100644
--- a/doc/man3/OSSL_ENCODER_CTX_new_for_pkey.pod
+++ b/doc/man3/OSSL_ENCODER_CTX_new_for_pkey.pod
@@ -60,6 +60,10 @@ zero).  This helps the caller to distinguish between an error when creating
 the B<OSSL_ENCODER_CTX> and missing encoder implementation, and allows it to
 act accordingly.
 
+Note that OSSL_ENCODER_CTX_new_for_pkey() finalises the OSSL_ENCODER_CTX;
+after that the OSSL_ENCODER_CTX_set_* and OSSL_ENCODER_CTX_add_* functions
+described in L<OSSL_ENCODER_CTX(3)> shouldn't be called.
+
 OSSL_ENCODER_CTX_set_cipher() tells the implementation what cipher
 should be used to encrypt encoded keys.  The cipher is given by
 name I<cipher_name>.  The interpretation of that I<cipher_name> is
diff --git a/doc/man3/OSSL_PROVIDER.pod b/doc/man3/OSSL_PROVIDER.pod
index 40a4ea100572..9992f4377d1b 100644
--- a/doc/man3/OSSL_PROVIDER.pod
+++ b/doc/man3/OSSL_PROVIDER.pod
@@ -152,7 +152,7 @@ I<capability>. For each capability of that name supported by the provider it
 will call the callback I<cb> and supply a set of L<OSSL_PARAM(3)>s describing the
 capability. It will also pass back the argument I<arg>. For more details about
 capabilities and what they can be used for please see
-L<provider-base(7)/CAPABILTIIES>.
+L<provider-base(7)/CAPABILITIES>.
 
 =head1 RETURN VALUES
 
@@ -213,7 +213,7 @@ The type and functions described here were added in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man3/SSL_CTX_set_cert_verify_callback.pod b/doc/man3/SSL_CTX_set_cert_verify_callback.pod
index be59a548cbd9..9e8b524a7df0 100644
--- a/doc/man3/SSL_CTX_set_cert_verify_callback.pod
+++ b/doc/man3/SSL_CTX_set_cert_verify_callback.pod
@@ -63,6 +63,11 @@ on resumption, even though no chain is presented int that case.
 Moreover, the calling application will be informed about the detailed result of
 the verification procedure and may elect to base further decisions on it.
 
+I<callback> may call L<X509_verify_cert(3)> to run the built-in verification
+function. This may be useful if application wishes to dynamically reconfigure
+I<x509_store_ctx> before verification, or postprocess the result. In this case,
+L<X509_verify_cert(3)> will set the B<error> member as described above.
+
 Within I<x509_store_ctx>, I<callback> has access to the I<verify_callback>
 function set using L<SSL_CTX_set_verify(3)>.
 
diff --git a/doc/man3/SSL_CTX_set_client_hello_cb.pod b/doc/man3/SSL_CTX_set_client_hello_cb.pod
index d592102028ce..b8522ebec5c8 100644
--- a/doc/man3/SSL_CTX_set_client_hello_cb.pod
+++ b/doc/man3/SSL_CTX_set_client_hello_cb.pod
@@ -67,6 +67,9 @@ holding the numerical value of the TLS extension types in the order they appear
 in the ClientHello.  B<*outlen> contains the number of elements in the array.
 In situations when the ClientHello has no extensions, the function will return
 success with B<*out> set to NULL and B<*outlen> set to 0.
+Note that SSL_client_hello_get1_extensions_present() returns only recognised
+extensions; therefore, unrecognised (including GREASE) extensions will not
+appear in the output.
 
 =head1 NOTES
 
@@ -85,8 +88,12 @@ not use a servername callback, in order to avoid unexpected behavior that
 occurs due to the relative order of processing between things like session
 resumption and the historical servername callback.
 
-The SSL_client_hello_* family of functions may only be called from code executing
-within a ClientHello callback.
+The SSL_client_hello_* family of functions may only be called from code
+executing within a ClientHello callback.
+
+The SSL_client_hello_get0_*() functions return raw ClientHello data, whereas
+SSL_client_hello_get1_extensions_present() returns only recognized extensions
+(so unknown/GREASE-extensions are not included).
 
 =head1 RETURN VALUES
 
diff --git a/doc/man3/X509_STORE_CTX_new.pod b/doc/man3/X509_STORE_CTX_new.pod
index 9929a98e0cf5..42c51d0fff4a 100644
--- a/doc/man3/X509_STORE_CTX_new.pod
+++ b/doc/man3/X509_STORE_CTX_new.pod
@@ -77,7 +77,7 @@ If I<ctx> is NULL nothing is done.
 X509_STORE_CTX_init() sets up I<ctx> for a subsequent verification operation.
 
 X509_STORE_CTX_init() initializes the internal state and resources of the
-given I<ctx>. Among others, it sets the verification parameters associcated
+given I<ctx>. Among others, it sets the verification parameters associated
 with the method name C<default>, which includes the C<any> purpose,
 and takes over callback function pointers from I<trust_store> (unless NULL).
 It must be called before each call to L<X509_verify_cert(3)> or
@@ -280,7 +280,7 @@ There is no need to call X509_STORE_CTX_cleanup() explicitly since OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2009-2023 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2009-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/doc/man3/X509_STORE_get0_param.pod b/doc/man3/X509_STORE_get0_param.pod
index d9413fd49e15..02585de140f4 100644
--- a/doc/man3/X509_STORE_get0_param.pod
+++ b/doc/man3/X509_STORE_get0_param.pod
@@ -29,7 +29,8 @@ X509 object cache. The cache contains B<X509> and B<X509_CRL> objects. The
 returned pointer must not be freed by the calling application.
 
 X509_STORE_get1_all_certs() returns a list of all certificates in the store.
-The caller is responsible for freeing the returned list.
+The caller is responsible for freeing the returned list
+with sk_X509_pop_free(sk, X509_free).
 
 =head1 RETURN VALUES
 
@@ -45,6 +46,7 @@ certificates on success, else NULL.
 
 =head1 SEE ALSO
 
+L<DEFINE_STACK_OF(3)>,
 L<X509_STORE_new(3)>
 
 =head1 HISTORY
diff --git a/doc/man7/openssl-env.pod b/doc/man7/openssl-env.pod
index c7dbd2277dc6..a71fc2c9a85f 100644
--- a/doc/man7/openssl-env.pod
+++ b/doc/man7/openssl-env.pod
@@ -61,7 +61,7 @@ Unless OpenSSL tracing support is generally disabled,
 enable trace output of specific parts of OpenSSL libraries, by name.
 This output usually makes sense only if you know OpenSSL internals well.
 
-The value of this environment varialble is a comma-separated list of names,
+The value of this environment variable is a comma-separated list of names,
 with the following available:
 
 =over 4
@@ -184,7 +184,7 @@ See L<OSSL_HTTP_parse_url(3)>.
 
 =head1 COPYRIGHT
 
-Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2019-2026 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy