SSL_PENDING(3ossl)

💖 SSL_PENDING(3ossl) — the OpenSSL page, bestie edition 💖

okay so this is the SSL_PENDING(3ossl) page from the OpenSSL manual, and we're about to talk about peeking at bytes that are just sitting there in your SSL object waiting to be read. no cap, this one is lowkey important and also kinda sneaky. let's get into it 🦋

---

✨ NAME ✨

SSL_pending, SSL_has_pending — check for readable bytes buffered in an SSL object

like. that's the whole job. we're checking the vibes of your buffer 💅

---

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

int SSL_pending(const SSL *ssl);
int SSL_has_pending(const SSL *s);

---

🎀 DESCRIPTION 🎀

okay so here's the tea 🍓. Data does not arrive one cute little byte at a time. It arrives in whole blocks called records, sent over from the peer. A whole record gets processed (think: decrypted) in one single go, and then OpenSSL buffers it until your application actually reads it by calling SSL_read_ex(3) or SSL_read(3).

SSL_pending() returns the number of bytes which have been processed, buffered, and are available inside ssl for immediate read. so like, "how much can I grab RIGHT NOW, no waiting" 💅

now here's the plot twist 🫢. If the SSL object's read_ahead flag is set (peep SSL_CTX_set_read_ahead(3)), then additional protocol bytes — beyond the current record — may have already been read, containing even more TLS/SSL records. This also applies to DTLS and pipelining (see SSL_CTX_set_split_send_fragment(3)). Those extra bytes get buffered by OpenSSL but they just... sit there, unprocessed, until they're needed.

and because those bytes are still in an unprocessed state, SSL_pending() will straight up ignore them. 🙈

so it is genuinely possible for no more bytes to be readable from the underlying BIO (because OpenSSL already read them, sneaky) and for SSL_pending() to return 0, even though readable application data bytes are available — because that data is chillin' inside unprocessed buffered records. it's giving "nothing to see here" while there's literally stuff to see. iconic behavior honestly.

SSL_has_pending() returns 1 if s has buffered data — whether processed or unprocessed — and 0 otherwise.

⚠️ and now the warning, bestie, pay attention: it is possible for SSL_has_pending() to return 1, and then a subsequent call to SSL_read_ex() or SSL_read() to return no data, because the unprocessed buffered data, when processed, yielded no application data. (for example this can happen during renegotiation.) It is also possible in this scenario for SSL_has_pending() to keep returning 1 even after an SSL_read_ex() or SSL_read() call, because the buffered and unprocessed data is not yet processable — e.g. because OpenSSL has only received a partial record so far. 😭

so yeah. 1 does not always mean "data for you". it means "there's stuff in here". big difference. iykyk.

---

🌈 RETURN VALUES 🌈

• SSL_pending() — returns the number of buffered and processed application data bytes that are pending and are available for immediate read. 🫶
• SSL_has_pending() — returns 1 if there is buffered record data in the SSL object, and 0 otherwise.

---

👑 SEE ALSO 👑

SSL_read_ex(3), SSL_read(3), SSL_CTX_set_read_ahead(3), SSL_CTX_set_split_send_fragment(3), ssl(7)

go read those too, they're the supporting cast and they ate ✨

---

🦋 HISTORY 🦋

The SSL_has_pending() function was added in OpenSSL 1.1.0. so it's not ancient, it's a newer icon 💜

---

💌 COPYRIGHT 💌

Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the page!! this was OpenSSL 3.5.9, dated 2026-09-29, filed under the manual name SSL_PENDING(3ossl). tysm for reading, bestie, go forth and check your pending bytes responsibly 🧚💖✨